Analysis

  • max time kernel
    164s
  • max time network
    32s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    15/11/2023, 11:24

General

  • Target

    Sourceforge_2415.exe

  • Size

    24KB

  • MD5

    266a15d9cba058894d2831ebcb588cbb

  • SHA1

    d2e0bd146f8fbf8fdfc7077e3ddf49c921a6f7fa

  • SHA256

    665da077f722090af0926c306b1463fee6e29edce548e7a6cb994a0038df077f

  • SHA512

    b8b401a8c6e087ef70ef755843c15151dc68a27f6a4821c86c2539e62e807e1e8f99ea67b5ae0c76d8a9e839dfe1d45e786c236550357a79410348a759db6d1a

  • SSDEEP

    384:bZmvgok696u08/P7Qo7EdAcMEalE3UWB8gw8/:bZJ8/MpdyPJWLw8/

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Sourceforge_2415.exe
    "C:\Users\Admin\AppData\Local\Temp\Sourceforge_2415.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2668
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 388
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2668-0-0x000007FEF50F0000-0x000007FEF5A8D000-memory.dmp

    Filesize

    9.6MB

  • memory/2668-1-0x0000000001E80000-0x0000000001F00000-memory.dmp

    Filesize

    512KB

  • memory/2668-2-0x000007FEF50F0000-0x000007FEF5A8D000-memory.dmp

    Filesize

    9.6MB

  • memory/2668-4-0x0000000001E80000-0x0000000001F00000-memory.dmp

    Filesize

    512KB

  • memory/2924-3-0x0000000001E40000-0x0000000001E41000-memory.dmp

    Filesize

    4KB