7a97d4b8f134c45154aedab0230867952cc203fd283dca4700258edc86efb1e9 | Triage

Analysis

max time kernel
5s
max time network
41s
platform
windows7_x64
resource
win7v20210410
submitted
22-07-2021 12:07

Sharing

Report Analysis Logs

General

Target

3e2a1681fc8caef1b5d72e60a2d79691.exe
Size

466KB
MD5

c8bbdf9e3b59abed712d50939b1aba06
SHA1

d15a034d62161837581791b7fbf696259f0dceeb
SHA256

7a97d4b8f134c45154aedab0230867952cc203fd283dca4700258edc86efb1e9
SHA512

71b2480ea3a6b69d4a225d48b669beae1a864b3ce7521d4b34e5958d0ac9f8b511ba4acd8592fe3da5c91adaa02de8e807cd84979e535d307b3b7f71af74865c

Score

1^/10

Malware Config

Signatures

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

3e2a1681fc8caef1b5d72e60a2d79691.exe

pid process

1988 3e2a1681fc8caef1b5d72e60a2d79691.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

3e2a1681fc8caef1b5d72e60a2d79691.exe

description	pid	process	target process
PID 1988 wrote to memory of 1300	1988	3e2a1681fc8caef1b5d72e60a2d79691.exe	MSBuild.exe
PID 1988 wrote to memory of 1300	1988	3e2a1681fc8caef1b5d72e60a2d79691.exe	MSBuild.exe
PID 1988 wrote to memory of 1300	1988	3e2a1681fc8caef1b5d72e60a2d79691.exe	MSBuild.exe
PID 1988 wrote to memory of 1300	1988	3e2a1681fc8caef1b5d72e60a2d79691.exe	MSBuild.exe
PID 1988 wrote to memory of 1300	1988	3e2a1681fc8caef1b5d72e60a2d79691.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\3e2a1681fc8caef1b5d72e60a2d79691.exe
"C:\Users\Admin\AppData\Local\Temp\3e2a1681fc8caef1b5d72e60a2d79691.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Users\Admin\AppData\Local\Temp\3e2a1681fc8caef1b5d72e60a2d79691.exe"
2⤵
PID:1300

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1988-60-0x0000000075161000-0x0000000075163000-memory.dmp

Filesize
8KB

Download
memory/1988-61-0x00000000002B0000-0x00000000002B2000-memory.dmp

Filesize
8KB

Download