cf35dd3598fb5919eceddb26c7b394763cad2102b034c0a83d149f9342520069

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
15/11/2023, 11:26

Target

Sourceforge_3871.exe
Size

20KB
MD5

a88815c400c250c645f08e5e7f9e036e
SHA1

33536940f6a7da645494f97bb0e8b8b252789cdc
SHA256

cf35dd3598fb5919eceddb26c7b394763cad2102b034c0a83d149f9342520069
SHA512

40f48fca2965a6607614d504b8ae92c64185912f9f0069525af363668c805122ccac96246af800d7799fd09f2fc6e779cbc7d6455608d9dd15d3d4d00f566edd
SSDEEP

96:MfcfE4ho3WTvJKVwsqoWt47ZP3D0CvSo/lufc9x+6wvFxF3hwaLPBjvnO/7g4:OoDt4tDpbuwsxBm7g

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2240	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2240	2104	Sourceforge_3871.exe	29
PID 2104 wrote to memory of 2240	2104	Sourceforge_3871.exe	29
PID 2104 wrote to memory of 2240	2104	Sourceforge_3871.exe	29

C:\Users\Admin\AppData\Local\Temp\Sourceforge_3871.exe
"C:\Users\Admin\AppData\Local\Temp\Sourceforge_3871.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 380
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2240

memory/2104-0-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmp

Filesize
9.6MB

Download
memory/2104-1-0x0000000001F80000-0x0000000002000000-memory.dmp

Filesize
512KB

Download
memory/2104-2-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmp

Filesize
9.6MB

Download
memory/2104-4-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmp

Filesize
9.6MB

Download
memory/2104-5-0x0000000001F80000-0x0000000002000000-memory.dmp

Filesize
512KB

Download
memory/2240-3-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download