db5273410c933a199d6cde35b970ba18de85f4194870fdfa9ccdead249ecae3b | Triage

Analysis

max time kernel
166s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/02/2023, 18:56

Sharing

Report Analysis Logs

General

Target

decrypted_1.exe
Size

596KB
MD5

06380f05b2f738a9b2238e9f41df139a
SHA1

440ee634c0f1ef203b453c690db10a38db1c10b6
SHA256

0411c4c02b0fb6c9009804722a71950a079552e7a9eb48b3f8e437bf310c7f89
SHA512

a30f4fd8ef901c3b66b7e6a2f3c192f9bee7f38156bc5fc7a41daa4b474b1f4dd7098b606f0e09e91d1263c88fd458636412d1c7697a90b4ef76aa2aaef1d52f
SSDEEP

12288:HI3mn6yMpQN+YsSsQeBn9EQ/4EJzKH5rYKG5Jm9g/C:o3m6nWqQuEEvGZrtWK1

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
792	dw20.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 792	940	decrypted_1.exe	28
PID 940 wrote to memory of 792	940	decrypted_1.exe	28
PID 940 wrote to memory of 792	940	decrypted_1.exe	28
PID 940 wrote to memory of 792	940	decrypted_1.exe	28

C:\Users\Admin\AppData\Local\Temp\decrypted_1.exe
"C:\Users\Admin\AppData\Local\Temp\decrypted_1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 440
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/940-54-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/940-57-0x0000000074230000-0x00000000747DB000-memory.dmp

Filesize
5.7MB

Download
memory/940-58-0x0000000074230000-0x00000000747DB000-memory.dmp

Filesize
5.7MB

Download