8a55a4265878988081873ea08672649aa11f63c8c53ea1cf1a1f6ebd7eae6a1b

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 12:00

Target

7a306628877449a2115b8fbd6c195cb4.exe
Size

141KB
MD5

7a306628877449a2115b8fbd6c195cb4
SHA1

35778aa7584b0ff45cc1c5deb53aa11b2780cf7c
SHA256

8a55a4265878988081873ea08672649aa11f63c8c53ea1cf1a1f6ebd7eae6a1b
SHA512

277b48be7e328443b72f0e713773ca7661fd126916755259f1ce200a3e6e738d7e15c98556f2fe8098cdb42d1bcd08478129ba23b390a82af7fe1d2717b41665
SSDEEP

1536:ARW6SeNU1eAel+OnveQ+6I1Y17JxaTFK2YHhhxExwHf8Gr+xFzXHC/wR:w7NU1N+Bn3HIG17v0a7xExwZEFrj

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1292	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 1292	2672	7a306628877449a2115b8fbd6c195cb4.exe	29
PID 2672 wrote to memory of 1292	2672	7a306628877449a2115b8fbd6c195cb4.exe	29
PID 2672 wrote to memory of 1292	2672	7a306628877449a2115b8fbd6c195cb4.exe	29

C:\Users\Admin\AppData\Local\Temp\7a306628877449a2115b8fbd6c195cb4.exe
"C:\Users\Admin\AppData\Local\Temp\7a306628877449a2115b8fbd6c195cb4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 396
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1292

memory/1292-3-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

Filesize
4KB

Download
memory/2672-0-0x000007FEF5CF0000-0x000007FEF668D000-memory.dmp

Filesize
9.6MB

Download
memory/2672-1-0x0000000000B00000-0x0000000000B80000-memory.dmp

Filesize
512KB

Download
memory/2672-2-0x000007FEF5CF0000-0x000007FEF668D000-memory.dmp

Filesize
9.6MB

Download
memory/2672-4-0x000007FEF5CF0000-0x000007FEF668D000-memory.dmp

Filesize
9.6MB

Download
memory/2672-5-0x0000000000B00000-0x0000000000B80000-memory.dmp

Filesize
512KB

Download