37733872a7d58215f79223dd43b1a92877f768bd1344d0570f2fe74ab4db520b | Triage

Analysis

max time kernel
107s
max time network
116s
platform
windows10_x64
resource
win10
submitted
07-07-2020 17:28

Sharing

Report Analysis Logs

General

Target

6ba7141682d990206505fc29ef16a43b.exe
Size

369KB
MD5

6ba7141682d990206505fc29ef16a43b
SHA1

b16adba264446d222fe6f4b9d3c9dd40e883bd5a
SHA256

37733872a7d58215f79223dd43b1a92877f768bd1344d0570f2fe74ab4db520b
SHA512

18a53177a9053607d86b4d8a7c03c505a5cc895f4bfae6842d707118f6aa38c018c19faf0200e1222a8d2eab78e8bbcb706ac170a56672f717959d4611494d2d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 3804	2920	6ba7141682d990206505fc29ef16a43b.exe	67
PID 2920 wrote to memory of 3804	2920	6ba7141682d990206505fc29ef16a43b.exe	67
PID 2920 wrote to memory of 3804	2920	6ba7141682d990206505fc29ef16a43b.exe	67

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	3804	dw20.exe
Token: SeBackupPrivilege	3804	dw20.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3804	dw20.exe
3804	dw20.exe

C:\Users\Admin\AppData\Local\Temp\6ba7141682d990206505fc29ef16a43b.exe
"C:\Users\Admin\AppData\Local\Temp\6ba7141682d990206505fc29ef16a43b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 1436
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:3804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3804-1-0x0000000002860000-0x0000000002861000-memory.dmp

Filesize
4KB

Download
memory/3804-2-0x0000000002860000-0x0000000002861000-memory.dmp

Filesize
4KB

Download
memory/3804-4-0x0000000002F10000-0x0000000002F11000-memory.dmp

Filesize
4KB

Download