ef2c970a5722d121a2ab6cab00b8d60d68a5ff8428c6d73a1de5a85fb42bf6b5

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
03/11/2023, 15:53

Target

NEAS.736d6df31b1cfc42580f818558d9cbc0.exe
Size

227KB
MD5

736d6df31b1cfc42580f818558d9cbc0
SHA1

2886bcf715aabb4ec5111e6b55571c400a127fb4
SHA256

ef2c970a5722d121a2ab6cab00b8d60d68a5ff8428c6d73a1de5a85fb42bf6b5
SHA512

0af9e0d7f14a3a161ce59a8f9db29039ef550de9831f10040f11d4393a417917f08199c90850d8a047c245f4a56ee380f46e40c6b472e92ad69cdd110b48dffa
SSDEEP

3072:YsXRmUIMitiMQose27vc+Eld+xZp2vPRL1tT06zJoxAWBcKpSP//dwRmIBk:ZR5IuMQoseGk7RZBGxAycKpSPX2i

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2776	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2776	1636	NEAS.736d6df31b1cfc42580f818558d9cbc0.exe	30
PID 1636 wrote to memory of 2776	1636	NEAS.736d6df31b1cfc42580f818558d9cbc0.exe	30
PID 1636 wrote to memory of 2776	1636	NEAS.736d6df31b1cfc42580f818558d9cbc0.exe	30

C:\Users\Admin\AppData\Local\Temp\NEAS.736d6df31b1cfc42580f818558d9cbc0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.736d6df31b1cfc42580f818558d9cbc0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 460
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2776

memory/1636-0-0x000007FEF5D70000-0x000007FEF670D000-memory.dmp

Filesize
9.6MB

Download
memory/1636-1-0x0000000000AA0000-0x0000000000B20000-memory.dmp

Filesize
512KB

Download
memory/1636-2-0x000007FEF5D70000-0x000007FEF670D000-memory.dmp

Filesize
9.6MB

Download
memory/1636-3-0x0000000000AA0000-0x0000000000B20000-memory.dmp

Filesize
512KB

Download
memory/1636-5-0x000007FEF5D70000-0x000007FEF670D000-memory.dmp

Filesize
9.6MB

Download
memory/1636-6-0x0000000000AA0000-0x0000000000B20000-memory.dmp

Filesize
512KB

Download
memory/2776-4-0x0000000000470000-0x0000000000471000-memory.dmp

Filesize
4KB

Download