26b59da1945bc4f0fc1d194f6982d607091fadfe7a32e4a63c94a88df7c129e3

Analysis

max time kernel
119s
max time network
136s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
15/11/2023, 11:17

Target

KaryNcube.exe
Size

32KB
MD5

a8b872b53f419ae9a992f2615da05407
SHA1

43f41e1c1c6a3d12ace9bbf947dbed5574d1b315
SHA256

26b59da1945bc4f0fc1d194f6982d607091fadfe7a32e4a63c94a88df7c129e3
SHA512

f5d70f1ccd2319ef9f65edbc41fa447d39f22f8de7c5018ff94189bff36c9ee241354ce783e7bf34b1c53729caec4ce8e6dc0f96d845035abfaee787462561cd
SSDEEP

384:qOTHgnczEIDhr9Hdemp/m5xZwPbNoO+1weets3NBT9DZa+X:qOU9Ih9Pxkxevi9B9NaC

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2552	dw20.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2552	2312	KaryNcube.exe	29
PID 2312 wrote to memory of 2552	2312	KaryNcube.exe	29
PID 2312 wrote to memory of 2552	2312	KaryNcube.exe	29
PID 2312 wrote to memory of 2552	2312	KaryNcube.exe	29

C:\Users\Admin\AppData\Local\Temp\KaryNcube.exe
"C:\Users\Admin\AppData\Local\Temp\KaryNcube.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 420
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2552

memory/2312-0-0x00000000740D0000-0x000000007467B000-memory.dmp

Filesize
5.7MB

Download
memory/2312-2-0x0000000000390000-0x00000000003D0000-memory.dmp

Filesize
256KB

Download
memory/2312-1-0x00000000740D0000-0x000000007467B000-memory.dmp

Filesize
5.7MB

Download
memory/2312-4-0x00000000740D0000-0x000000007467B000-memory.dmp

Filesize
5.7MB

Download
memory/2312-5-0x0000000000390000-0x00000000003D0000-memory.dmp

Filesize
256KB

Download
memory/2552-3-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download
memory/2552-6-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download