65fa93616cdb8c92a541dd2ad8468d6688e1b1f2606891b56db3e90fbfc9acbd | Triage

Resubmissions

12-11-2024 01:29

241112-bwgrxs1gnf 10

08-07-2021 12:18

210708-8z6d5h8z2n 10

06-07-2021 17:53

210706-g6we6sa7sa 10

19-06-2021 18:17

210619-vr8bj2dzfn 10

17-06-2021 21:39

210617-a9cvlnmrbx 10

11-06-2021 17:26

210611-wvab1yw2tj 10

08-06-2021 06:47

210608-qrbpch3y46 10

08-06-2021 06:47

210608-64tndgm1ln 10

05-06-2021 18:40

210605-cd6qpr55sx 10

04-06-2021 11:56

210604-5c416rs3ns 10

Analysis

max time kernel
47s
max time network
69s
platform
windows10_x64
resource
win10v20210408
submitted
27-05-2021 20:06

Sharing

Report Analysis Logs

General

Target

Install.exe

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1256	Install.tmp

Loads dropped DLL 1 IoCs

pid	Process
1256	Install.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 1256	2988	Install.exe	72
PID 2988 wrote to memory of 1256	2988	Install.exe	72
PID 2988 wrote to memory of 1256	2988	Install.exe	72

C:\Users\Admin\AppData\Local\Temp\Install.exe
"C:\Users\Admin\AppData\Local\Temp\Install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Users\Admin\AppData\Local\Temp\is-N6PMD.tmp\Install.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-N6PMD.tmp\Install.tmp" /SL5="$20114,235791,152064,C:\Users\Admin\AppData\Local\Temp\Install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1256-118-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2988-114-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download