65fa93616cdb8c92a541dd2ad8468d6688e1b1f2606891b56db3e90fbfc9acbd | Triage

Resubmissions

12-11-2024 01:29

241112-bwgrxs1gnf 10

08-07-2021 12:18

210708-8z6d5h8z2n 10

06-07-2021 17:53

210706-g6we6sa7sa 10

19-06-2021 18:17

210619-vr8bj2dzfn 10

17-06-2021 21:39

210617-a9cvlnmrbx 10

11-06-2021 17:26

210611-wvab1yw2tj 10

08-06-2021 06:47

210608-qrbpch3y46 10

08-06-2021 06:47

210608-64tndgm1ln 10

05-06-2021 18:40

210605-cd6qpr55sx 10

04-06-2021 11:56

210604-5c416rs3ns 10

Analysis

max time kernel
1684s
max time network
1713s
platform
windows7_x64
resource
win7v20210408
submitted
27-05-2021 20:06

Sharing

Report Analysis Logs

General

Target

Install.exe

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1976	Install.tmp

Loads dropped DLL 4 IoCs

pid	Process
1028	Install.exe
1976	Install.tmp
1976	Install.tmp
1976	Install.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 1976	1028	Install.exe	26
PID 1028 wrote to memory of 1976	1028	Install.exe	26
PID 1028 wrote to memory of 1976	1028	Install.exe	26
PID 1028 wrote to memory of 1976	1028	Install.exe	26
PID 1028 wrote to memory of 1976	1028	Install.exe	26
PID 1028 wrote to memory of 1976	1028	Install.exe	26
PID 1028 wrote to memory of 1976	1028	Install.exe	26

C:\Users\Admin\AppData\Local\Temp\Install.exe
"C:\Users\Admin\AppData\Local\Temp\Install.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Users\Admin\AppData\Local\Temp\is-O870N.tmp\Install.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-O870N.tmp\Install.tmp" /SL5="$3015C,235791,152064,C:\Users\Admin\AppData\Local\Temp\Install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1028-60-0x00000000750C1000-0x00000000750C3000-memory.dmp

Filesize
8KB

Download
memory/1028-61-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1976-70-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download