5d97127302fd36f004e1a29c4e2cd8583ae6940fe5f16d1c8454885ae288cd8b | Triage

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7v20201028
submitted
04-03-2021 17:24

Sharing

Report Analysis Logs

General

Target

START_ME.exe
Size

981KB
MD5

e3484a2aa73999f679732235728cc7e0
SHA1

800d1156db2a05ad9856741588cedb6b56185ac3
SHA256

343a5cbc98aff11e7d0ec6582e953df9bf3f0ecd41bead7365f13a382d64721e
SHA512

02eaf2e42898430fd08a82bd7c43d297ec188d4d98495c73059923a75c40b58d2a7def37b84e13ac8de8fca88175284121634a71ea187171dbb283dd366dabd9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

START_ME.exe

description	pid	process	target process
PID 1924 wrote to memory of 1640	1924	START_ME.exe	simulation.exe
PID 1924 wrote to memory of 1640	1924	START_ME.exe	simulation.exe
PID 1924 wrote to memory of 1640	1924	START_ME.exe	simulation.exe
PID 1924 wrote to memory of 1640	1924	START_ME.exe	simulation.exe

C:\Users\Admin\AppData\Local\Temp\START_ME.exe
"C:\Users\Admin\AppData\Local\Temp\START_ME.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1924

C:\Users\Admin\AppData\Local\Temp\assets\simulation.exe
"assets\simulation.exe"
2⤵
PID:1640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1640-2-0x0000000000000000-mapping.dmp

Download