cc06edbf7d6ece435e21ac7dc0c23252f4e81a25d5bc40fc05ad12396149b456

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
19/11/2023, 11:32

Target

cc06edbf7d6ece435e21ac7dc0c23252f4e81a25d5bc40fc05ad12396149b456.exe
Size

4KB
MD5

62e0b21ad75d984e0b901b5f23df0e5d
SHA1

9d25588a474dab5c50fbec017bab69ec83d0dfe8
SHA256

cc06edbf7d6ece435e21ac7dc0c23252f4e81a25d5bc40fc05ad12396149b456
SHA512

f96da1337a445700646f8c8a077a88e6d933cc428bb86e362f1e29d89238fe55c9bd9b9b40a3f6fef612f7e5edca7869ccdc7d8dad4c76ba327c9f8089da5efb

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1896	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 1896	2208	cc06edbf7d6ece435e21ac7dc0c23252f4e81a25d5bc40fc05ad12396149b456.exe	28
PID 2208 wrote to memory of 1896	2208	cc06edbf7d6ece435e21ac7dc0c23252f4e81a25d5bc40fc05ad12396149b456.exe	28
PID 2208 wrote to memory of 1896	2208	cc06edbf7d6ece435e21ac7dc0c23252f4e81a25d5bc40fc05ad12396149b456.exe	28

C:\Users\Admin\AppData\Local\Temp\cc06edbf7d6ece435e21ac7dc0c23252f4e81a25d5bc40fc05ad12396149b456.exe
"C:\Users\Admin\AppData\Local\Temp\cc06edbf7d6ece435e21ac7dc0c23252f4e81a25d5bc40fc05ad12396149b456.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 364
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1896

memory/1896-2-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/2208-0-0x000007FEF6090000-0x000007FEF6A2D000-memory.dmp

Filesize
9.6MB

Download
memory/2208-1-0x00000000000E0000-0x0000000000160000-memory.dmp

Filesize
512KB

Download
memory/2208-3-0x000007FEF6090000-0x000007FEF6A2D000-memory.dmp

Filesize
9.6MB

Download
memory/2208-4-0x00000000000E0000-0x0000000000160000-memory.dmp

Filesize
512KB

Download