120edd37142c24d17472137c608220220a4efb595d42a991efd498ac30339b4e | Triage

Resubmissions

24-11-2022 08:19

221124-j741laba85 4

24-11-2022 07:16

221124-h33rasgc78 4

Analysis

max time kernel
108s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 07:16

Sharing

Report Analysis Logs

General

Target

Server.exe
Size

150KB
MD5

0f367fce0c77e594ec09f105ded2503a
SHA1

fba1dd99300e2c9d574a4afa976590b6da35ee50
SHA256

120edd37142c24d17472137c608220220a4efb595d42a991efd498ac30339b4e
SHA512

a8a6d855805f9e223478191577bbe981d09b988fdb20c64fa62431587b122424b2d868f82feaeb3e5be6e4aa49ccc3cf842c592ead2d8c645f497f1b69764f3f
SSDEEP

3072:+FhkwDd+B2lf1oJWT9RMkjWyqQuRN4GepKsqL4:+Pk0d+Bo6JWT93q9/4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Server.exe

description	pid	process	target process
PID 616 wrote to memory of 1248	616	Server.exe	dw20.exe
PID 616 wrote to memory of 1248	616	Server.exe	dw20.exe
PID 616 wrote to memory of 1248	616	Server.exe	dw20.exe
PID 616 wrote to memory of 1248	616	Server.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:616

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 440
2⤵
PID:1248

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/616-54-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download
memory/616-57-0x0000000074C80000-0x000000007522B000-memory.dmp

Filesize
5.7MB

Download
memory/616-58-0x0000000074C80000-0x000000007522B000-memory.dmp

Filesize
5.7MB

Download
memory/616-59-0x0000000074C80000-0x000000007522B000-memory.dmp

Filesize
5.7MB

Download
memory/1248-55-0x0000000000000000-mapping.dmp

Download