bb03c50f22d1ebe124d8397f70bec91d982485dc31c7a3131b078c544b371067

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
15/11/2023, 11:23

Target

Sourceforge_1249.exe
Size

20KB
MD5

864e74c0c6eac5503d4cc3f56a80d741
SHA1

8d131c4e73bd77ea1e1ac0ac6c5bc5c4c2dd318f
SHA256

bb03c50f22d1ebe124d8397f70bec91d982485dc31c7a3131b078c544b371067
SHA512

2e71729a810268ed9081b6394a5d623593ee675612f12049f91d601ad32ef7eb4d981de5836e32fc7776550beaac8b6ead81e41a86e46f71d4f8f18b0e72ab33
SSDEEP

96:QMWlb7cbBn+mr2/3P8m0ZovgYpbzLaaYcvqqsNHGmAsQptWtV/cR3pYKgw5AlZl7:QRGrLPSDpfxv4pw4rU3pYKgwKZ1uQ

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3000	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 3000	2112	Sourceforge_1249.exe	29
PID 2112 wrote to memory of 3000	2112	Sourceforge_1249.exe	29
PID 2112 wrote to memory of 3000	2112	Sourceforge_1249.exe	29

C:\Users\Admin\AppData\Local\Temp\Sourceforge_1249.exe
"C:\Users\Admin\AppData\Local\Temp\Sourceforge_1249.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 396
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3000

memory/2112-0-0x000007FEF5C60000-0x000007FEF65FD000-memory.dmp

Filesize
9.6MB

Download
memory/2112-1-0x0000000001F10000-0x0000000001F90000-memory.dmp

Filesize
512KB

Download
memory/2112-3-0x000007FEF5C60000-0x000007FEF65FD000-memory.dmp

Filesize
9.6MB

Download
memory/2112-4-0x0000000001F10000-0x0000000001F90000-memory.dmp

Filesize
512KB

Download
memory/3000-2-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download