23b36227b42d1eeb5b055918029774f0bed6ae8f973c217f798c3756467f6d85

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
28-10-2023 19:53

Target

NEAS.43b2958799e98eaf7b7d6358c14cbf10.exe
Size

432KB
MD5

43b2958799e98eaf7b7d6358c14cbf10
SHA1

f1a9c7aefcc271dd147efb604dd6b905dc96f613
SHA256

23b36227b42d1eeb5b055918029774f0bed6ae8f973c217f798c3756467f6d85
SHA512

ec65f5abd2492aa6afbb7a06e4acd457f92cdc70c7c668171f45f9389c91437b937a297f9f3514137935ac44c03a19e6ebdc304457e3de787ec72e66017faf12
SSDEEP

6144:Cow2AtCBRZesDm47BuEPGeP1QYx+374dxHJdmhm/OV0EMkTRkR:Co5zRZfnBFPGoHPmhm/ijT

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1544	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1544	1504	NEAS.43b2958799e98eaf7b7d6358c14cbf10.exe	29
PID 1504 wrote to memory of 1544	1504	NEAS.43b2958799e98eaf7b7d6358c14cbf10.exe	29
PID 1504 wrote to memory of 1544	1504	NEAS.43b2958799e98eaf7b7d6358c14cbf10.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.43b2958799e98eaf7b7d6358c14cbf10.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.43b2958799e98eaf7b7d6358c14cbf10.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 380
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1544

memory/1504-0-0x000007FEF5270000-0x000007FEF5C0D000-memory.dmp

Filesize
9.6MB

Download
memory/1504-1-0x0000000001FA0000-0x0000000002020000-memory.dmp

Filesize
512KB

Download
memory/1504-2-0x000007FEF5270000-0x000007FEF5C0D000-memory.dmp

Filesize
9.6MB

Download
memory/1504-4-0x000007FEF5270000-0x000007FEF5C0D000-memory.dmp

Filesize
9.6MB

Download
memory/1504-5-0x0000000001FA0000-0x0000000002020000-memory.dmp

Filesize
512KB

Download
memory/1544-3-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download