Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    22/12/2023, 04:19

General

  • Target

    627136e8b7a5398f4460434afdf237eb.exe

  • Size

    706KB

  • MD5

    627136e8b7a5398f4460434afdf237eb

  • SHA1

    8d16014c422cc493a3731188ca69e5814a5536fa

  • SHA256

    cf4724697820c0277fbb5ff93640bae28fa03d58baa1208d211544d0b6133a1a

  • SHA512

    54cabf43ff70626c51c3e98a4b97bec97017cde2a2cccb2e8b4087494f212ba3636d7b414fb1f28a2e7b8f8cb68b9ff40ab8231eaece8667151b763832decbbd

  • SSDEEP

    1536:4YRoiYUWx4qG4QhuT+zg2hD276gh+CI1bbxkz4z5FDWsIAgURDx1Nxywru:4YrGOH4Zs9fvxkz4FFDWsI8x1Nxdr

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\627136e8b7a5398f4460434afdf237eb.exe
    "C:\Users\Admin\AppData\Local\Temp\627136e8b7a5398f4460434afdf237eb.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2224
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
      dw20.exe -x -s 480
      2⤵
        PID:2416

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2224-0-0x0000000074800000-0x0000000074DAB000-memory.dmp

      Filesize

      5.7MB

    • memory/2224-1-0x0000000074800000-0x0000000074DAB000-memory.dmp

      Filesize

      5.7MB

    • memory/2224-2-0x0000000000410000-0x0000000000450000-memory.dmp

      Filesize

      256KB

    • memory/2224-4-0x0000000074800000-0x0000000074DAB000-memory.dmp

      Filesize

      5.7MB

    • memory/2224-5-0x0000000000410000-0x0000000000450000-memory.dmp

      Filesize

      256KB

    • memory/2416-3-0x00000000005E0000-0x00000000005E1000-memory.dmp

      Filesize

      4KB

    • memory/2416-6-0x00000000005E0000-0x00000000005E1000-memory.dmp

      Filesize

      4KB