c343484f0bf8bca543c0d3764ea92b70f348d6c5eb55456a32ec33054e862020

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
15/11/2023, 11:24

Target

Sourceforge_2435.exe
Size

68KB
MD5

942fb34b110d493ea0fd353f40947f42
SHA1

79349709ed6cff3a08f66b35b2eb6c1dc7cb2031
SHA256

c343484f0bf8bca543c0d3764ea92b70f348d6c5eb55456a32ec33054e862020
SHA512

df0198c4ae320596b61156454c5f2fec528f72e3c3530bff958e28d9f8df19531b8cf6e163458984f7583abdd2fe61d23a12ff5ec0304af258508b052b723f54
SSDEEP

1536:ZVstZUffqZzRY7Q+GWH1JgzCJHpV4d9tZUffqZz:ZVcIQhCJ0dN

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2472	dw20.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2472	2252	Sourceforge_2435.exe	28
PID 2252 wrote to memory of 2472	2252	Sourceforge_2435.exe	28
PID 2252 wrote to memory of 2472	2252	Sourceforge_2435.exe	28
PID 2252 wrote to memory of 2472	2252	Sourceforge_2435.exe	28

C:\Users\Admin\AppData\Local\Temp\Sourceforge_2435.exe
"C:\Users\Admin\AppData\Local\Temp\Sourceforge_2435.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 416
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2472

memory/2252-0-0x0000000074D30000-0x00000000752DB000-memory.dmp

Filesize
5.7MB

Download
memory/2252-1-0x0000000074D30000-0x00000000752DB000-memory.dmp

Filesize
5.7MB

Download
memory/2252-2-0x0000000001F70000-0x0000000001FB0000-memory.dmp

Filesize
256KB

Download
memory/2252-4-0x0000000074D30000-0x00000000752DB000-memory.dmp

Filesize
5.7MB

Download
memory/2252-5-0x0000000001F70000-0x0000000001FB0000-memory.dmp

Filesize
256KB

Download
memory/2472-3-0x00000000004E0000-0x00000000004E1000-memory.dmp

Filesize
4KB

Download
memory/2472-6-0x00000000004E0000-0x00000000004E1000-memory.dmp

Filesize
4KB

Download