4ded006c5ba232cb317ab4326d0caed59fe1bf26361467f38428e4ac50b1f333

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
15/11/2023, 11:26

Target

Sourceforge_3652.exe
Size

20KB
MD5

34addbf622d3b4bafe0a706f380941e6
SHA1

5dc23e808800e006e7b9d9e79118fbaab594fe66
SHA256

4ded006c5ba232cb317ab4326d0caed59fe1bf26361467f38428e4ac50b1f333
SHA512

cdb63d8df4eb573ab3d8910243c49b04a79b25e403038a06617e33f8fda8eb00a7e99ade6eeae07dbb32d14b1418016142b83209a498f3bc6f3ead846ac2dd86
SSDEEP

96:jO+ShPU6r+i0PIeUQ/k3X1FFkS3FMfr/iCZo6Addxh/Im:jOx5US90PIepq1FFkS1MxnAdD

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2752	dw20.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2752	1740	Sourceforge_3652.exe	29
PID 1740 wrote to memory of 2752	1740	Sourceforge_3652.exe	29
PID 1740 wrote to memory of 2752	1740	Sourceforge_3652.exe	29
PID 1740 wrote to memory of 2752	1740	Sourceforge_3652.exe	29

C:\Users\Admin\AppData\Local\Temp\Sourceforge_3652.exe
"C:\Users\Admin\AppData\Local\Temp\Sourceforge_3652.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 420
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2752

memory/1740-0-0x0000000074D70000-0x000000007531B000-memory.dmp

Filesize
5.7MB

Download
memory/1740-2-0x0000000001F60000-0x0000000001FA0000-memory.dmp

Filesize
256KB

Download
memory/1740-1-0x0000000074D70000-0x000000007531B000-memory.dmp

Filesize
5.7MB

Download
memory/1740-4-0x0000000074D70000-0x000000007531B000-memory.dmp

Filesize
5.7MB

Download
memory/1740-5-0x0000000001F60000-0x0000000001FA0000-memory.dmp

Filesize
256KB

Download
memory/2752-3-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download
memory/2752-6-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download