0cad80d77df92287c3823b526a50f93d74708a3d5dafeade7e2ee1f725fa1a2c

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
15/11/2023, 11:23

Target

SoundcardSelector.exe
Size

28KB
MD5

65dfe0e113a2385f792b3e4750a1f57c
SHA1

a04260e8bd279a7a48f8ce735f7551916591ada4
SHA256

0cad80d77df92287c3823b526a50f93d74708a3d5dafeade7e2ee1f725fa1a2c
SHA512

b2e101bffe394650173b130faa4043d40a6d76f6c42a851ee31c8802be744c4812040eedd3d2b8ed800f1bccdc9dbee309e6bf8bd4566825e4c373ba13a94446
SSDEEP

384:EkLEqmv2Q6u2Y+jC00mS1a7+pbkTKVsh5PO4:EkLEkbA7b9Vsh5p

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2144	dw20.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2144	2340	SoundcardSelector.exe	28
PID 2340 wrote to memory of 2144	2340	SoundcardSelector.exe	28
PID 2340 wrote to memory of 2144	2340	SoundcardSelector.exe	28
PID 2340 wrote to memory of 2144	2340	SoundcardSelector.exe	28

C:\Users\Admin\AppData\Local\Temp\SoundcardSelector.exe
"C:\Users\Admin\AppData\Local\Temp\SoundcardSelector.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 452
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2144

memory/2144-3-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2144-5-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2340-0-0x0000000074FB0000-0x000000007555B000-memory.dmp

Filesize
5.7MB

Download
memory/2340-2-0x0000000001E60000-0x0000000001EA0000-memory.dmp

Filesize
256KB

Download
memory/2340-1-0x0000000074FB0000-0x000000007555B000-memory.dmp

Filesize
5.7MB

Download
memory/2340-4-0x0000000074FB0000-0x000000007555B000-memory.dmp

Filesize
5.7MB

Download