3478de6af99949129aed42d75779a78f1ac2cf2139837a559aadf13985c6c12c

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
15/11/2023, 11:12

Target

525.exe
Size

16KB
MD5

b65cfd4a3ede73c72d30aac2b4c13090
SHA1

d50d70fef388cd84b0eeb9da522f4a789141187e
SHA256

3478de6af99949129aed42d75779a78f1ac2cf2139837a559aadf13985c6c12c
SHA512

3a8cb580b7bd51c97f14feaba4a17dd3085a1429743967199eb044229ccbaee9bbe99971832e4ce00b7a16b6dc498c6bb588d08a3c2c70ce448b8547bf56d8a1
SSDEEP

48:6zW4AhPlbs9wAxNzJYR8EnKRfoHP7Bl+cUV1sf/DBl+OT9d9:CjAhPlbowAbKHTtfbd

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2924	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 2924	1280	525.exe	28
PID 1280 wrote to memory of 2924	1280	525.exe	28
PID 1280 wrote to memory of 2924	1280	525.exe	28

C:\Users\Admin\AppData\Local\Temp\525.exe
"C:\Users\Admin\AppData\Local\Temp\525.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 368
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2924

memory/1280-0-0x000007FEF5160000-0x000007FEF5AFD000-memory.dmp

Filesize
9.6MB

Download
memory/1280-1-0x0000000002040000-0x00000000020C0000-memory.dmp

Filesize
512KB

Download
memory/1280-3-0x000007FEF5160000-0x000007FEF5AFD000-memory.dmp

Filesize
9.6MB

Download
memory/1280-4-0x0000000002040000-0x00000000020C0000-memory.dmp

Filesize
512KB

Download
memory/2924-2-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download