07470371b6c705a49965ae5d98e26450b9fef50e4ba4851de91e29e9721ab197

Analysis

max time kernel
148s
max time network
146s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
15/11/2023, 11:13

Target

2314.exe
Size

5KB
MD5

d9086aab959707dd1a8643f3df70db9d
SHA1

31e855c2fbd8f69b0cc149696e3fd9ca887a30c4
SHA256

07470371b6c705a49965ae5d98e26450b9fef50e4ba4851de91e29e9721ab197
SHA512

7ce65c130e3e13683a0265fb5171d2a869f0c5059ee1e38728736963c832af4cebfe9b2384b7e12beac21f0414c54ed021d331d4f51ebb1ed5f34d6e709eca57
SSDEEP

48:6PYfPQwY7B/6U7ghNb6REKUh7U2+Ivpo/fD3K/zDbdstXe8ZWfZEpK5zhGB5WguN:BPBYHguj2xvpafD3KrDbdsfWO0VmWgO

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2752	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2752	2644	2314.exe	29
PID 2644 wrote to memory of 2752	2644	2314.exe	29
PID 2644 wrote to memory of 2752	2644	2314.exe	29

C:\Users\Admin\AppData\Local\Temp\2314.exe
"C:\Users\Admin\AppData\Local\Temp\2314.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 368
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2752

memory/2644-0-0x000007FEF4FF0000-0x000007FEF598D000-memory.dmp

Filesize
9.6MB

Download
memory/2644-1-0x0000000000A90000-0x0000000000B10000-memory.dmp

Filesize
512KB

Download
memory/2644-2-0x000007FEF4FF0000-0x000007FEF598D000-memory.dmp

Filesize
9.6MB

Download
memory/2644-4-0x000007FEF4FF0000-0x000007FEF598D000-memory.dmp

Filesize
9.6MB

Download
memory/2644-5-0x0000000000A90000-0x0000000000B10000-memory.dmp

Filesize
512KB

Download
memory/2752-3-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

Filesize
4KB

Download