ba090f00dec7afbd561670d2a345193fe2d8c10688aa3b5c73972918d1a55a4a

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
26-06-2024 05:25

Target

Connectifyd.exe
Size

872KB
MD5

66aed09819ac3be90305498a3759f42a
SHA1

b39e24ea7c2bacfa95f66a4401679667a5665bae
SHA256

9f6f03e14ce31cd68acea296c99dd8f458f2ff1e171e0c1d1231678255e75e3d
SHA512

63ec22ca9e4ac83cdbd9d358b75dbea0ce5417b914dd4c478bdce138fb06935a63bd5edd4e814c721f8f376156a372984ec5cb904cdf93c99cba94c3d6c0922e
SSDEEP

24576:28rPfjTI8Q8AjoGi48PR5mJ6Z2pIjBOi0kJZIbTgc:28rPfjTI8Q8AjoGi48PR5mJ6Z2pIjBOV

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

dw20.exe

pid process

2320 dw20.exe

pid	process
2320	dw20.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Connectifyd.exe

description	pid	process	target process
PID 2244 wrote to memory of 2320	2244	Connectifyd.exe	dw20.exe
PID 2244 wrote to memory of 2320	2244	Connectifyd.exe	dw20.exe
PID 2244 wrote to memory of 2320	2244	Connectifyd.exe	dw20.exe
PID 2244 wrote to memory of 2320	2244	Connectifyd.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\Connectifyd.exe
"C:\Users\Admin\AppData\Local\Temp\Connectifyd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2244

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 616
2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2320

memory/2244-0-0x0000000074B31000-0x0000000074B32000-memory.dmp

Filesize
4KB

Download
memory/2244-1-0x0000000074B30000-0x00000000750DB000-memory.dmp

Filesize
5.7MB

Download
memory/2244-2-0x0000000074B30000-0x00000000750DB000-memory.dmp

Filesize
5.7MB

Download
memory/2244-4-0x0000000074B30000-0x00000000750DB000-memory.dmp

Filesize
5.7MB

Download
memory/2244-5-0x0000000074B30000-0x00000000750DB000-memory.dmp

Filesize
5.7MB

Download
memory/2320-3-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download