cd8bfc79a21655ac653c24dcd3960bd113f99091504ac486007b3cb28ac69df4 | Triage

Analysis

max time kernel
163s
max time network
130s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 14:26

Sharing

Report Analysis Logs

General

Target

DWM7.exe
Size

816KB
MD5

a68f9d828dd808c7fc9b3dfc7d313ef0
SHA1

8b3a60f2329d159a06ee8b4feb704494dfc91825
SHA256

cd8bfc79a21655ac653c24dcd3960bd113f99091504ac486007b3cb28ac69df4
SHA512

5567cae4137794874c0f48c0dbcbc9aaa9757e800aa8435833255f703e0a731747b91b91326a84cc4542f421b7e06b36af214b9fbf2e46b3eeeeef0128be4296
SSDEEP

24576:oEnu1l+HdsAMaXt6uC56GoZTQZzCfFQ3C:oEnaJAMahCJoZMZzWFQ3C

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2736	1720	DWM7.exe	29
PID 1720 wrote to memory of 2736	1720	DWM7.exe	29
PID 1720 wrote to memory of 2736	1720	DWM7.exe	29

C:\Users\Admin\AppData\Local\Temp\DWM7.exe
"C:\Users\Admin\AppData\Local\Temp\DWM7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c embedded.exe
  2⤵
  PID:2736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1720-0-0x000000013FA80000-0x000000013FB28000-memory.dmp

Filesize
672KB

Download