1945e6d2f2cf5548f7db69f43fbcdddac5c165cb98019705ff44b7d84021ad6f | Triage

Analysis

max time kernel
92s
max time network
11s
platform
windows7_x64
resource
win7v20210410
submitted
28-06-2021 13:20

Sharing

Report Analysis Logs

General

Target

608efbf2b10d687c286d6f69f0b585250f90f015827115e79a41b899c638e8d3.exe
Size

452KB
MD5

383965a8c7287d52e33d376a99021e3e
SHA1

a81b0e215009108d74114df96f7670ef1d5545cb
SHA256

608efbf2b10d687c286d6f69f0b585250f90f015827115e79a41b899c638e8d3
SHA512

92a27c0057d4fc99c1fc1d969683aac90b24283553d6d317061e89cfa428c70248075bca70df995ba358c42c498a5691b448a0a5ab519c1c01f8849bc76c0494

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 1080	1420	608efbf2b10d687c286d6f69f0b585250f90f015827115e79a41b899c638e8d3.exe	30
PID 1420 wrote to memory of 1080	1420	608efbf2b10d687c286d6f69f0b585250f90f015827115e79a41b899c638e8d3.exe	30
PID 1420 wrote to memory of 1080	1420	608efbf2b10d687c286d6f69f0b585250f90f015827115e79a41b899c638e8d3.exe	30
PID 1420 wrote to memory of 1080	1420	608efbf2b10d687c286d6f69f0b585250f90f015827115e79a41b899c638e8d3.exe	30

C:\Users\Admin\AppData\Local\Temp\608efbf2b10d687c286d6f69f0b585250f90f015827115e79a41b899c638e8d3.exe
"C:\Users\Admin\AppData\Local\Temp\608efbf2b10d687c286d6f69f0b585250f90f015827115e79a41b899c638e8d3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 768
  2⤵
  PID:1080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1080-64-0x0000000002800000-0x0000000002801000-memory.dmp

Filesize
4KB

Download
memory/1420-60-0x0000000074FB1000-0x0000000074FB3000-memory.dmp

Filesize
8KB

Download
memory/1420-61-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Filesize
4KB

Download