db5273410c933a199d6cde35b970ba18de85f4194870fdfa9ccdead249ecae3b | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/02/2023, 18:56

Sharing

Report Analysis Logs

General

Target

Decrypter_1.exe
Size

52KB
MD5

6d1ba676170ee73f766248116cdb6e93
SHA1

f19a13ff28e26e421d6cf1c4b8c3acf18e3cadf1
SHA256

b617e08abf22ea6bf953033c43da733dfa4a786c1bceee31f04a44dd01e73294
SHA512

a6104a75424eea410bfa443c784ca04f9578eb40ca93c128a66f1c72e4a88790f5cde132380aa65268d0126be0e7ea175ff89361574d863ea0c646ad4cad8ad2
SSDEEP

768:wuumZxpL0il0rv/V02NoizUZ/GhlecXSpc9XWuwrm7GGul:R7jdLl0zVN/zUZ/Ghl1vzJ7Il

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 1240	1404	Decrypter_1.exe	28
PID 1404 wrote to memory of 1240	1404	Decrypter_1.exe	28
PID 1404 wrote to memory of 1240	1404	Decrypter_1.exe	28
PID 1404 wrote to memory of 1240	1404	Decrypter_1.exe	28

C:\Users\Admin\AppData\Local\Temp\Decrypter_1.exe
"C:\Users\Admin\AppData\Local\Temp\Decrypter_1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 412
  2⤵
  PID:1240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1404-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1404-57-0x00000000743D0000-0x000000007497B000-memory.dmp

Filesize
5.7MB

Download
memory/1404-58-0x00000000743D0000-0x000000007497B000-memory.dmp

Filesize
5.7MB

Download