de2d99521958912be7aab35242bb4e8e0e0298ac5c5f613edac47d925337744f

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/09/2024, 03:45

Target

de2d99521958912be7aab35242bb4e8e0e0298ac5c5f613edac47d925337744f.exe
Size

1.6MB
MD5

a4d9409625f18dbff1024d5cd5f75760
SHA1

9f8a68082850e429e0f2abddb0d80438843211ec
SHA256

de2d99521958912be7aab35242bb4e8e0e0298ac5c5f613edac47d925337744f
SHA512

bffd78bcfba78dc8ad9e8fea3b7f71640f597f86f8ac530351c6e0f03be5e8e6f06461d286f06b42c040e8915b8f8ab926d9872f6df8753280ef198e79598fba
SSDEEP

24576:p/IMK4g2j8eRWGv7i8nzZ2bp1NjCyEt63sbFliVscJ:pgMX8eRvuQzWp1hCasb3escJ

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2348	de2d99521958912be7aab35242bb4e8e0e0298ac5c5f613edac47d925337744f.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2348	de2d99521958912be7aab35242bb4e8e0e0298ac5c5f613edac47d925337744f.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2348	de2d99521958912be7aab35242bb4e8e0e0298ac5c5f613edac47d925337744f.exe
2348	de2d99521958912be7aab35242bb4e8e0e0298ac5c5f613edac47d925337744f.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2024	2348	de2d99521958912be7aab35242bb4e8e0e0298ac5c5f613edac47d925337744f.exe	30
PID 2348 wrote to memory of 2024	2348	de2d99521958912be7aab35242bb4e8e0e0298ac5c5f613edac47d925337744f.exe	30
PID 2348 wrote to memory of 2024	2348	de2d99521958912be7aab35242bb4e8e0e0298ac5c5f613edac47d925337744f.exe	30

C:\Users\Admin\AppData\Local\Temp\de2d99521958912be7aab35242bb4e8e0e0298ac5c5f613edac47d925337744f.exe
"C:\Users\Admin\AppData\Local\Temp\de2d99521958912be7aab35242bb4e8e0e0298ac5c5f613edac47d925337744f.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 776
  2⤵
  PID:2024

memory/2024-7-0x0000000000470000-0x0000000000471000-memory.dmp

Filesize
4KB

Download
memory/2024-10-0x0000000000470000-0x0000000000471000-memory.dmp

Filesize
4KB

Download
memory/2348-0-0x000007FEF56BE000-0x000007FEF56BF000-memory.dmp

Filesize
4KB

Download
memory/2348-1-0x000007FEF5400000-0x000007FEF5D9D000-memory.dmp

Filesize
9.6MB

Download
memory/2348-2-0x000000001B160000-0x000000001B274000-memory.dmp

Filesize
1.1MB

Download
memory/2348-3-0x000007FEF5400000-0x000007FEF5D9D000-memory.dmp

Filesize
9.6MB

Download
memory/2348-4-0x000007FEF5400000-0x000007FEF5D9D000-memory.dmp

Filesize
9.6MB

Download
memory/2348-5-0x000007FEF5400000-0x000007FEF5D9D000-memory.dmp

Filesize
9.6MB

Download
memory/2348-6-0x000007FEF5400000-0x000007FEF5D9D000-memory.dmp

Filesize
9.6MB

Download
memory/2348-8-0x000007FEF5400000-0x000007FEF5D9D000-memory.dmp

Filesize
9.6MB

Download
memory/2348-9-0x000007FEF56BE000-0x000007FEF56BF000-memory.dmp

Filesize
4KB

Download