7e2cab589582f46ff463d9dcbc659df25128ce23bd896184f5f6f6233818b249

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
15-11-2023 11:25

Target

Sourceforge_2984.exe
Size

11KB
MD5

b4d5137244bb4259a208b815e7c9f7b9
SHA1

76f6be34e0e95bf8948cbe5efb197c2de0fee06a
SHA256

7e2cab589582f46ff463d9dcbc659df25128ce23bd896184f5f6f6233818b249
SHA512

08cc8f9436995e6f583d59bf6f0318efeac874712988a2dc26b4df41b338db03bc19a7bb682ef16008e29388bf693c6bcf5f9ecf146ed797637a4496ca5f73e5
SSDEEP

192:aHU+SwxBUW9sWvQKPnEtObMacxc8hjXHUz1Tr+foFc5:Ru2W9sWvLXci2jXHU

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2236	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2236	2172	Sourceforge_2984.exe	28
PID 2172 wrote to memory of 2236	2172	Sourceforge_2984.exe	28
PID 2172 wrote to memory of 2236	2172	Sourceforge_2984.exe	28

C:\Users\Admin\AppData\Local\Temp\Sourceforge_2984.exe
"C:\Users\Admin\AppData\Local\Temp\Sourceforge_2984.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 924
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2236

memory/2172-9-0x000007FEF5420000-0x000007FEF5DBD000-memory.dmp

Filesize
9.6MB

Download
memory/2172-10-0x0000000000A10000-0x0000000000A90000-memory.dmp

Filesize
512KB

Download
memory/2172-11-0x000007FEF5420000-0x000007FEF5DBD000-memory.dmp

Filesize
9.6MB

Download
memory/2172-13-0x000007FEF5420000-0x000007FEF5DBD000-memory.dmp

Filesize
9.6MB

Download
memory/2172-14-0x0000000000A10000-0x0000000000A90000-memory.dmp

Filesize
512KB

Download
memory/2236-12-0x0000000000470000-0x0000000000471000-memory.dmp

Filesize
4KB

Download