36af16f1951a6edc1cbcd5a15c4bc1a68b2ce829a632e5ff2f37cf2167eac659

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-08-2024 11:30

Target

De4dot [Modded ArmDot]/AssemblyServer-CLR20-x64.exe
Size

4KB
MD5

bfa084eecdb01f256a319d0265987280
SHA1

fbc420e5df0d363dc3dfba41b6e9cb02fd90c8b3
SHA256

291d34f2e417eaff204da8daacf8215248a943e96c8476abaf4bdff63382fbc1
SHA512

83480f9c0976bcc0d6002789fe30f92814f8bb99411c4083f3a2fbeaf5796f592caa72f64d329133d0eca003be84e57f06ee3eddbc24cdc875a0db232cdec131
SSDEEP

48:6rh1CxV4rTMMHtPDp21gDyMkKKrn4ZLCVCOpfbNtm:jErTftbpgvr4kUAzNt

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2180	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2180	2980	AssemblyServer-CLR20-x64.exe	31
PID 2980 wrote to memory of 2180	2980	AssemblyServer-CLR20-x64.exe	31
PID 2980 wrote to memory of 2180	2980	AssemblyServer-CLR20-x64.exe	31

C:\Users\Admin\AppData\Local\Temp\De4dot [Modded ArmDot]\AssemblyServer-CLR20-x64.exe
"C:\Users\Admin\AppData\Local\Temp\De4dot [Modded ArmDot]\AssemblyServer-CLR20-x64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 348
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2180

memory/2180-2-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download
memory/2980-0-0x000007FEF573E000-0x000007FEF573F000-memory.dmp

Filesize
4KB

Download
memory/2980-1-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download
memory/2980-3-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download