f6463095a7fb0446a198419d5cb74c96eee676ebdcda8e3e77053cf084eaf567

Analysis

max time kernel
118s
max time network
141s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
15/11/2023, 11:26

Target

Sourceforge_3512.exe
Size

35KB
MD5

8045faa715517a36014a7fb0b403d1cf
SHA1

01c64e1bfe6a13acaed4d71202c36ddcacc7c564
SHA256

f6463095a7fb0446a198419d5cb74c96eee676ebdcda8e3e77053cf084eaf567
SHA512

f725f99acc17c555056b6b79802fd3ec596b0bcaab7abbf35af3f4daafdaf3c3a5d273adb38df0f04a76f7503d776d00435394ac0dcef471f7a29824bf7e1a17
SSDEEP

384:bpkbkKWGbVmSzVFzpRtDwsfBIhOpyWL1wJlfaFLxovP96uXr3eJc1U39G5DfQpX5:y3zcYwwc3eJcC90DSXcqxjtEowuCJS

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1588	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1588	2180	Sourceforge_3512.exe	28
PID 2180 wrote to memory of 1588	2180	Sourceforge_3512.exe	28
PID 2180 wrote to memory of 1588	2180	Sourceforge_3512.exe	28

C:\Users\Admin\AppData\Local\Temp\Sourceforge_3512.exe
"C:\Users\Admin\AppData\Local\Temp\Sourceforge_3512.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 384
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1588

memory/1588-3-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2180-0-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/2180-1-0x0000000000B40000-0x0000000000BC0000-memory.dmp

Filesize
512KB

Download
memory/2180-2-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/2180-4-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/2180-5-0x0000000000B40000-0x0000000000BC0000-memory.dmp

Filesize
512KB

Download