b97e56c803f09e7fbd1a49a6e20a4832cb5eb0223b0fb3a0535b04bab1204341

Analysis

max time kernel
133s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
21-12-2022 05:15

Target

b97e56c803f09e7fbd1a49a6e20a4832cb5eb0223b0fb3a0535b04bab1204341.exe
Size

225KB
MD5

c7dd8bb71c94e1063eb69e59c2117a30
SHA1

96abba8ee688a9b0de94619f3981ed5e2c2ac940
SHA256

b97e56c803f09e7fbd1a49a6e20a4832cb5eb0223b0fb3a0535b04bab1204341
SHA512

bd56b5cadba71b540cf69bb2f3b344b2e8f1168d54842ac7a1f07125fc3061a118aab8811563348cd11ce538a090842a73573cac1b0335b471632f5eb2d281b4
SSDEEP

6144:LiIO3p8NWQxyP82k/ruyxt4GhbB+R/6QXPQ584E+:2f4Jd2k/rtgR/7u+

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
972	dw20.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 972	1976	b97e56c803f09e7fbd1a49a6e20a4832cb5eb0223b0fb3a0535b04bab1204341.exe	28
PID 1976 wrote to memory of 972	1976	b97e56c803f09e7fbd1a49a6e20a4832cb5eb0223b0fb3a0535b04bab1204341.exe	28
PID 1976 wrote to memory of 972	1976	b97e56c803f09e7fbd1a49a6e20a4832cb5eb0223b0fb3a0535b04bab1204341.exe	28
PID 1976 wrote to memory of 972	1976	b97e56c803f09e7fbd1a49a6e20a4832cb5eb0223b0fb3a0535b04bab1204341.exe	28

C:\Users\Admin\AppData\Local\Temp\b97e56c803f09e7fbd1a49a6e20a4832cb5eb0223b0fb3a0535b04bab1204341.exe
"C:\Users\Admin\AppData\Local\Temp\b97e56c803f09e7fbd1a49a6e20a4832cb5eb0223b0fb3a0535b04bab1204341.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 388
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:972

memory/1976-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1976-57-0x0000000074300000-0x00000000748AB000-memory.dmp

Filesize
5.7MB

Download
memory/1976-58-0x0000000074300000-0x00000000748AB000-memory.dmp

Filesize
5.7MB

Download