ba090f00dec7afbd561670d2a345193fe2d8c10688aa3b5c73972918d1a55a4a

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
26/06/2024, 05:25

Target

Connectifyd.exe
Size

872KB
MD5

66aed09819ac3be90305498a3759f42a
SHA1

b39e24ea7c2bacfa95f66a4401679667a5665bae
SHA256

9f6f03e14ce31cd68acea296c99dd8f458f2ff1e171e0c1d1231678255e75e3d
SHA512

63ec22ca9e4ac83cdbd9d358b75dbea0ce5417b914dd4c478bdce138fb06935a63bd5edd4e814c721f8f376156a372984ec5cb904cdf93c99cba94c3d6c0922e
SSDEEP

24576:28rPfjTI8Q8AjoGi48PR5mJ6Z2pIjBOi0kJZIbTgc:28rPfjTI8Q8AjoGi48PR5mJ6Z2pIjBOV

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2320	dw20.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2320	2244	Connectifyd.exe	29
PID 2244 wrote to memory of 2320	2244	Connectifyd.exe	29
PID 2244 wrote to memory of 2320	2244	Connectifyd.exe	29
PID 2244 wrote to memory of 2320	2244	Connectifyd.exe	29

C:\Users\Admin\AppData\Local\Temp\Connectifyd.exe
"C:\Users\Admin\AppData\Local\Temp\Connectifyd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 616
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2320

memory/2244-0-0x0000000074B31000-0x0000000074B32000-memory.dmp

Filesize
4KB

Download
memory/2244-1-0x0000000074B30000-0x00000000750DB000-memory.dmp

Filesize
5.7MB

Download
memory/2244-2-0x0000000074B30000-0x00000000750DB000-memory.dmp

Filesize
5.7MB

Download
memory/2244-4-0x0000000074B30000-0x00000000750DB000-memory.dmp

Filesize
5.7MB

Download
memory/2244-5-0x0000000074B30000-0x00000000750DB000-memory.dmp

Filesize
5.7MB

Download
memory/2320-3-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download