37733872a7d58215f79223dd43b1a92877f768bd1344d0570f2fe74ab4db520b | Triage

Analysis

max time kernel
139s
max time network
69s
platform
windows7_x64
resource
win7v200430
submitted
07-07-2020 17:28

Sharing

Report Analysis Logs

General

Target

6ba7141682d990206505fc29ef16a43b.exe
Size

369KB
MD5

6ba7141682d990206505fc29ef16a43b
SHA1

b16adba264446d222fe6f4b9d3c9dd40e883bd5a
SHA256

37733872a7d58215f79223dd43b1a92877f768bd1344d0570f2fe74ab4db520b
SHA512

18a53177a9053607d86b4d8a7c03c505a5cc895f4bfae6842d707118f6aa38c018c19faf0200e1222a8d2eab78e8bbcb706ac170a56672f717959d4611494d2d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6ba7141682d990206505fc29ef16a43b.exe

description	pid	process	target process
PID 1400 wrote to memory of 1796	1400	6ba7141682d990206505fc29ef16a43b.exe	dw20.exe
PID 1400 wrote to memory of 1796	1400	6ba7141682d990206505fc29ef16a43b.exe	dw20.exe
PID 1400 wrote to memory of 1796	1400	6ba7141682d990206505fc29ef16a43b.exe	dw20.exe
PID 1400 wrote to memory of 1796	1400	6ba7141682d990206505fc29ef16a43b.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\6ba7141682d990206505fc29ef16a43b.exe
"C:\Users\Admin\AppData\Local\Temp\6ba7141682d990206505fc29ef16a43b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1400

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 944
2⤵
PID:1796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1796-0-0x0000000000000000-mapping.dmp

Download
memory/1796-1-0x0000000001EC0000-0x0000000001ED1000-memory.dmp

Filesize
68KB

Download