7775e63aeb7f42c2112118d39e3c87d0d9618b2e83173719e9d5c2049899269e | Triage

Analysis

max time kernel
141s
max time network
22s
platform
windows7_x64
resource
win7v200430
submitted
09/07/2020, 13:46

Sharing

Report Analysis Logs

General

Target

7775e63aeb7f42c2112118d39e3c87d0d9618b2e83173719e9d5c2049899269e.exe
Size

5KB
MD5

f9d87efa9e7c1dc50fbc643eb76bb500
SHA1

bebf1e4b4824c9d87bcc846cea9352ecb632bc25
SHA256

7775e63aeb7f42c2112118d39e3c87d0d9618b2e83173719e9d5c2049899269e
SHA512

bbab0263027a4e8495c182b27b869ddbcadf76945d2f0bd8f43fe776bda211b21fda6a3318401825cc1fce6a234adb3c4b0b532a59acfbabd253b7501983ef2d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 1784	1296	7775e63aeb7f42c2112118d39e3c87d0d9618b2e83173719e9d5c2049899269e.exe	27
PID 1296 wrote to memory of 1784	1296	7775e63aeb7f42c2112118d39e3c87d0d9618b2e83173719e9d5c2049899269e.exe	27
PID 1296 wrote to memory of 1784	1296	7775e63aeb7f42c2112118d39e3c87d0d9618b2e83173719e9d5c2049899269e.exe	27

C:\Users\Admin\AppData\Local\Temp\7775e63aeb7f42c2112118d39e3c87d0d9618b2e83173719e9d5c2049899269e.exe
"C:\Users\Admin\AppData\Local\Temp\7775e63aeb7f42c2112118d39e3c87d0d9618b2e83173719e9d5c2049899269e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 536
  2⤵
  PID:1784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1784-1-0x0000000001F70000-0x0000000001F81000-memory.dmp

Filesize
68KB

Download