5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991 | Triage

Analysis

max time kernel
56s
max time network
44s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
02-08-2022 02:18

Sharing

Report Analysis Logs

General

Target

5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe
Size

658KB
MD5

8ab0bc1a07b752cf0ceb06f27cc75c0c
SHA1

df3e3763855f58c40eee189907dc5486ae1b7fbf
SHA256

5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991
SHA512

d9880bd6686645ff0d42825eb13105198526de7a95304a7423d0a3aab3512f8e5cb215ef4e8e561df576e32aa85fa83c73fe1f2c6f5ad3c4e1e86efb85485c9c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1092	1680	5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe	27
PID 1680 wrote to memory of 1092	1680	5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe	27
PID 1680 wrote to memory of 1092	1680	5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe	27
PID 1680 wrote to memory of 1092	1680	5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe	27

C:\Users\Admin\AppData\Local\Temp\5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe
"C:\Users\Admin\AppData\Local\Temp\5ac794720953c80689558faace35e80d20d92a99be6c5b2c5d3b937631438991.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 804
  2⤵
  PID:1092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1680-54-0x0000000075251000-0x0000000075253000-memory.dmp

Filesize
8KB

Download
memory/1680-55-0x00000000749A0000-0x0000000074F4B000-memory.dmp

Filesize
5.7MB

Download
memory/1680-56-0x00000000749A0000-0x0000000074F4B000-memory.dmp

Filesize
5.7MB

Download