1c65f36c73b0fd003c64e1cb341204dce749a162ca764d4bff4d347c5da65478

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 00:51

Target

NEAS.ff49deece23d5d07c224ba981866d130.exe
Size

34KB
MD5

ff49deece23d5d07c224ba981866d130
SHA1

c5be6d23d8b944561892ebea580e616a481cb69e
SHA256

1c65f36c73b0fd003c64e1cb341204dce749a162ca764d4bff4d347c5da65478
SHA512

49ffb879dfceddbacb897eda6be7ea0a31b8c1f2661906effdeb806454e3e4b47d7442b13f73cfac82fc4c5ad13df5b37d6cf199c9d0b702540834b359fa9db2
SSDEEP

768:KvJprxpunVd2xIbyR3tY8g7+VwkzWnlB7iGkWCEvaR14l:K7uny3VgaVL4lB7iGkWCEv214

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2448	dw20.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2448	2944	NEAS.ff49deece23d5d07c224ba981866d130.exe	28
PID 2944 wrote to memory of 2448	2944	NEAS.ff49deece23d5d07c224ba981866d130.exe	28
PID 2944 wrote to memory of 2448	2944	NEAS.ff49deece23d5d07c224ba981866d130.exe	28
PID 2944 wrote to memory of 2448	2944	NEAS.ff49deece23d5d07c224ba981866d130.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.ff49deece23d5d07c224ba981866d130.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.ff49deece23d5d07c224ba981866d130.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 472
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2448

memory/2448-4-0x0000000001F30000-0x0000000001F31000-memory.dmp

Filesize
4KB

Download
memory/2448-7-0x0000000001F30000-0x0000000001F31000-memory.dmp

Filesize
4KB

Download
memory/2944-0-0x0000000074250000-0x00000000747FB000-memory.dmp

Filesize
5.7MB

Download
memory/2944-1-0x0000000074250000-0x00000000747FB000-memory.dmp

Filesize
5.7MB

Download
memory/2944-2-0x0000000000B00000-0x0000000000B40000-memory.dmp

Filesize
256KB

Download
memory/2944-3-0x0000000000B00000-0x0000000000B40000-memory.dmp

Filesize
256KB

Download
memory/2944-5-0x0000000074250000-0x00000000747FB000-memory.dmp

Filesize
5.7MB

Download
memory/2944-6-0x0000000000B00000-0x0000000000B40000-memory.dmp

Filesize
256KB

Download