5cebcff2fbff9992bc52a32bc2312d04a34afb664d7c237d6376da11b6526688

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
15/11/2023, 11:26

Target

Sourceforge_3787.exe
Size

7KB
MD5

1dbf0fe76cfe7ad3f080f2c2f27a4c57
SHA1

dc5eb1849c2e9fac339c61f90958d7045f9c7c01
SHA256

5cebcff2fbff9992bc52a32bc2312d04a34afb664d7c237d6376da11b6526688
SHA512

55670273e1ee12d6e0ea7493ed395e1bfb200be52f85fe8f73f9b871c204f292630a0976d09a7be8a47dca4075588d748cd70c8d18ca2739445e4765b6fa11a4
SSDEEP

96:cAZFXLopjatlXhVtj/0F7zBt0bntluZbphC0Vzr8O5ouM2NSEzNt:FD70Fhtmnt0x3z5JM28u

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2304	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2304	2180	Sourceforge_3787.exe	29
PID 2180 wrote to memory of 2304	2180	Sourceforge_3787.exe	29
PID 2180 wrote to memory of 2304	2180	Sourceforge_3787.exe	29

C:\Users\Admin\AppData\Local\Temp\Sourceforge_3787.exe
"C:\Users\Admin\AppData\Local\Temp\Sourceforge_3787.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 380
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2304

memory/2180-0-0x000007FEF5A10000-0x000007FEF63AD000-memory.dmp

Filesize
9.6MB

Download
memory/2180-1-0x00000000009D0000-0x0000000000A50000-memory.dmp

Filesize
512KB

Download
memory/2180-2-0x000007FEF5A10000-0x000007FEF63AD000-memory.dmp

Filesize
9.6MB

Download
memory/2180-4-0x000007FEF5A10000-0x000007FEF63AD000-memory.dmp

Filesize
9.6MB

Download
memory/2180-5-0x00000000009D0000-0x0000000000A50000-memory.dmp

Filesize
512KB

Download
memory/2304-3-0x0000000001CB0000-0x0000000001CB1000-memory.dmp

Filesize
4KB

Download