b6fa6c6eda847b0886239c298632deca91411bebd2a05dde31f0a373a8558154

Analysis

max time kernel
122s
max time network
28s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31-03-2023 12:54

Target

Desktop/bbbd5d0aef3c2cfa296cee376dea6d7eb777a9c12140aed1a7c2c8d6ecda1e26.exe
Size

25KB
MD5

953f090e710bd66e07e83c82afff4d9c
SHA1

c49dce1cdf5bab3e641a736a6c07015e963860f9
SHA256

bbbd5d0aef3c2cfa296cee376dea6d7eb777a9c12140aed1a7c2c8d6ecda1e26
SHA512

8f2377dacfd5ee1a2ba5c3da88525ce50a68b2fd35bc65c71056148cb0d6ec5925b2d379ed5fbaab2416234b19f16dbd16a38d6be182381cb2f619089c5562f7
SSDEEP

384:15ZYpNGs0U92jj6hCWyv0T4gjGShWM8rZLNr3BNAeIwtPcn3CAm9OZN9MNssq:daNGLU92KgbG4WXWHVTPIwtccakT

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

dw20.exe

pid process

1528 dw20.exe

pid	process
1528	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

bbbd5d0aef3c2cfa296cee376dea6d7eb777a9c12140aed1a7c2c8d6ecda1e26.exe

description	pid	process	target process
PID 1556 wrote to memory of 1528	1556	bbbd5d0aef3c2cfa296cee376dea6d7eb777a9c12140aed1a7c2c8d6ecda1e26.exe	dw20.exe
PID 1556 wrote to memory of 1528	1556	bbbd5d0aef3c2cfa296cee376dea6d7eb777a9c12140aed1a7c2c8d6ecda1e26.exe	dw20.exe
PID 1556 wrote to memory of 1528	1556	bbbd5d0aef3c2cfa296cee376dea6d7eb777a9c12140aed1a7c2c8d6ecda1e26.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\Desktop\bbbd5d0aef3c2cfa296cee376dea6d7eb777a9c12140aed1a7c2c8d6ecda1e26.exe
"C:\Users\Admin\AppData\Local\Temp\Desktop\bbbd5d0aef3c2cfa296cee376dea6d7eb777a9c12140aed1a7c2c8d6ecda1e26.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1556

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
dw20.exe -x -s 376
2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1528

memory/1528-56-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/1556-54-0x000000013F040000-0x000000013F04A000-memory.dmp

Filesize
40KB

Download
memory/1556-55-0x00000000022B0000-0x0000000002330000-memory.dmp

Filesize
512KB

Download
memory/1556-57-0x00000000022B0000-0x0000000002330000-memory.dmp

Filesize
512KB

Download