65fa93616cdb8c92a541dd2ad8468d6688e1b1f2606891b56db3e90fbfc9acbd | Triage

Resubmissions

12-11-2024 01:29

241112-bwgrxs1gnf 10

08-07-2021 12:18

210708-8z6d5h8z2n 10

06-07-2021 17:53

210706-g6we6sa7sa 10

19-06-2021 18:17

210619-vr8bj2dzfn 10

17-06-2021 21:39

210617-a9cvlnmrbx 10

11-06-2021 17:26

210611-wvab1yw2tj 10

08-06-2021 06:47

210608-qrbpch3y46 10

08-06-2021 06:47

210608-64tndgm1ln 10

05-06-2021 18:40

210605-cd6qpr55sx 10

04-06-2021 11:56

210604-5c416rs3ns 10

Analysis

max time kernel
1439s
max time network
1487s
platform
windows7_x64
resource
win7v20210410
submitted
17-06-2021 21:39

Sharing

Report Analysis Logs

General

Target

Install2.exe
Size

497KB
MD5

41a5f4fd1ea7cac4aa94a87aebccfef0
SHA1

0d0abf079413a4c773754bf4fda338dc5b9a8ddc
SHA256

97e95e99fd499ec45a7c1d8683d5731ce5e7a8fb8b710622e578cd169a00d8d9
SHA512

5ca14bda498f26efff4e1179969b8f2c25244063c7bf25f3ec20b5cd24b5be320bbfb8b3d0b2d66f5c5b415da777a766fece5f251a4247773c6cb991417fb75f

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1284	Install2.tmp

Loads dropped DLL 4 IoCs

pid	Process
1632	Install2.exe
1284	Install2.tmp
1284	Install2.tmp
1284	Install2.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1284	1632	Install2.exe	26
PID 1632 wrote to memory of 1284	1632	Install2.exe	26
PID 1632 wrote to memory of 1284	1632	Install2.exe	26
PID 1632 wrote to memory of 1284	1632	Install2.exe	26
PID 1632 wrote to memory of 1284	1632	Install2.exe	26
PID 1632 wrote to memory of 1284	1632	Install2.exe	26
PID 1632 wrote to memory of 1284	1632	Install2.exe	26

C:\Users\Admin\AppData\Local\Temp\Install2.exe
"C:\Users\Admin\AppData\Local\Temp\Install2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Users\Admin\AppData\Local\Temp\is-PM8CU.tmp\Install2.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-PM8CU.tmp\Install2.tmp" /SL5="$9015C,235791,152064,C:\Users\Admin\AppData\Local\Temp\Install2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1284-70-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/1632-60-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/1632-61-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download