db5273410c933a199d6cde35b970ba18de85f4194870fdfa9ccdead249ecae3b | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-02-2023 19:33

Sharing

Report Analysis Logs

General

Target

decrypted_1.exe
Size

596KB
MD5

06380f05b2f738a9b2238e9f41df139a
SHA1

440ee634c0f1ef203b453c690db10a38db1c10b6
SHA256

0411c4c02b0fb6c9009804722a71950a079552e7a9eb48b3f8e437bf310c7f89
SHA512

a30f4fd8ef901c3b66b7e6a2f3c192f9bee7f38156bc5fc7a41daa4b474b1f4dd7098b606f0e09e91d1263c88fd458636412d1c7697a90b4ef76aa2aaef1d52f
SSDEEP

12288:HI3mn6yMpQN+YsSsQeBn9EQ/4EJzKH5rYKG5Jm9g/C:o3m6nWqQuEEvGZrtWK1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 1228	112	decrypted_1.exe	28
PID 112 wrote to memory of 1228	112	decrypted_1.exe	28
PID 112 wrote to memory of 1228	112	decrypted_1.exe	28
PID 112 wrote to memory of 1228	112	decrypted_1.exe	28

C:\Users\Admin\AppData\Local\Temp\decrypted_1.exe
"C:\Users\Admin\AppData\Local\Temp\decrypted_1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:112
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 436
  2⤵
  PID:1228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/112-54-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download
memory/112-56-0x0000000074C30000-0x00000000751DB000-memory.dmp

Filesize
5.7MB

Download
memory/112-58-0x0000000074C30000-0x00000000751DB000-memory.dmp

Filesize
5.7MB

Download