db5273410c933a199d6cde35b970ba18de85f4194870fdfa9ccdead249ecae3b | Triage

Analysis

max time kernel
133s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/02/2023, 18:55

Sharing

Report Analysis Logs

General

Target

Decrypter_1.exe
Size

52KB
MD5

6d1ba676170ee73f766248116cdb6e93
SHA1

f19a13ff28e26e421d6cf1c4b8c3acf18e3cadf1
SHA256

b617e08abf22ea6bf953033c43da733dfa4a786c1bceee31f04a44dd01e73294
SHA512

a6104a75424eea410bfa443c784ca04f9578eb40ca93c128a66f1c72e4a88790f5cde132380aa65268d0126be0e7ea175ff89361574d863ea0c646ad4cad8ad2
SSDEEP

768:wuumZxpL0il0rv/V02NoizUZ/GhlecXSpc9XWuwrm7GGul:R7jdLl0zVN/zUZ/Ghl1vzJ7Il

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1972	dw20.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1972	2012	Decrypter_1.exe	28
PID 2012 wrote to memory of 1972	2012	Decrypter_1.exe	28
PID 2012 wrote to memory of 1972	2012	Decrypter_1.exe	28
PID 2012 wrote to memory of 1972	2012	Decrypter_1.exe	28

C:\Users\Admin\AppData\Local\Temp\Decrypter_1.exe
"C:\Users\Admin\AppData\Local\Temp\Decrypter_1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 412
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-54-0x00000000760D1000-0x00000000760D3000-memory.dmp

Filesize
8KB

Download
memory/2012-55-0x0000000074E00000-0x00000000753AB000-memory.dmp

Filesize
5.7MB

Download
memory/2012-58-0x0000000074E00000-0x00000000753AB000-memory.dmp

Filesize
5.7MB

Download