f3a252ae1c07384680cc843cd53a56bf4313e92d41cb895838de5bba1dd60530

Analysis

max time kernel
83s
max time network
78s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3a252ae1c07384680cc843cd53a56bf4313e92d41cb895838de5bba1dd60530.exe
Size

217KB
MD5

90de9a63aaac9ce804d3f0705cee4eff
SHA1

25cf01065e18e0aa09765ffa7222dbdcb94cf569
SHA256

f3a252ae1c07384680cc843cd53a56bf4313e92d41cb895838de5bba1dd60530
SHA512

29a42941d2d29a68cb6b82075e8ce83696f3c418337d03a7c67ca50eafd0c8f090f956207f05d38d5ef132e4daa7fc2d433868974cad19e860e1b4e11574ce98
SSDEEP

6144:aBC2F8NXC796TB9vj48ABIWo8MG0cRT/ayO1:a7eVQkTrvj42bIT9

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f3a252ae1c07384680cc843cd53a56bf4313e92d41cb895838de5bba1dd60530.exe

description pid process

Token: SeDebugPrivilege 760 f3a252ae1c07384680cc843cd53a56bf4313e92d41cb895838de5bba1dd60530.exe

description	pid	process
Token: SeDebugPrivilege	760	f3a252ae1c07384680cc843cd53a56bf4313e92d41cb895838de5bba1dd60530.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

f3a252ae1c07384680cc843cd53a56bf4313e92d41cb895838de5bba1dd60530.exe

description	pid	process	target process
PID 760 wrote to memory of 1100	760	f3a252ae1c07384680cc843cd53a56bf4313e92d41cb895838de5bba1dd60530.exe	dw20.exe
PID 760 wrote to memory of 1100	760	f3a252ae1c07384680cc843cd53a56bf4313e92d41cb895838de5bba1dd60530.exe	dw20.exe
PID 760 wrote to memory of 1100	760	f3a252ae1c07384680cc843cd53a56bf4313e92d41cb895838de5bba1dd60530.exe	dw20.exe
PID 760 wrote to memory of 1100	760	f3a252ae1c07384680cc843cd53a56bf4313e92d41cb895838de5bba1dd60530.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\f3a252ae1c07384680cc843cd53a56bf4313e92d41cb895838de5bba1dd60530.exe
"C:\Users\Admin\AppData\Local\Temp\f3a252ae1c07384680cc843cd53a56bf4313e92d41cb895838de5bba1dd60530.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:760

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 916
2⤵
PID:1100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/760-54-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-57-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/760-58-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-59-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-60-0x00000000744E0000-0x0000000074A8B000-memory.dmp

Filesize
5.7MB

Download
memory/760-62-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-61-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-63-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-64-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-65-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-67-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-66-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-68-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-69-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-72-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-73-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-71-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-70-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-74-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-75-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-76-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-77-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-79-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-80-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-78-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-81-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-82-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-83-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-84-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-85-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-86-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-87-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-89-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-88-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-90-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-91-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-92-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/760-93-0x00000000744E0000-0x0000000074A8B000-memory.dmp

Filesize
5.7MB

Download
memory/1100-94-0x0000000000000000-mapping.dmp

Download