5d3e5503103fe87851128da37f39fdc2e500d7bbf9f69e681745e582db9450a5 | Triage

Analysis

max time kernel
10s
max time network
152s
platform
windows10_x64
resource
win10v20210410
submitted
29-07-2021 10:38

Sharing

Report Analysis Logs

General

Target

9ec869cb94d730926ac5bd94ee0724e5bb8a94eb.exe
Size

476KB
MD5

f5bf7345faf95d1997b4db8d72018a62
SHA1

9ec869cb94d730926ac5bd94ee0724e5bb8a94eb
SHA256

5d3e5503103fe87851128da37f39fdc2e500d7bbf9f69e681745e582db9450a5
SHA512

7ad9c11158402a42d6b601cf467b2d0093439d9aae85fc3eab9f5f631ec1398298b2c7b10b9be6a7b88d0f9a41e16e99de1f6403b4dd2f0a4ed64b908b1de302

Score

1^/10

Malware Config

Signatures

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
500	9ec869cb94d730926ac5bd94ee0724e5bb8a94eb.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 500 wrote to memory of 1344	500	9ec869cb94d730926ac5bd94ee0724e5bb8a94eb.exe	75
PID 500 wrote to memory of 1344	500	9ec869cb94d730926ac5bd94ee0724e5bb8a94eb.exe	75
PID 500 wrote to memory of 1344	500	9ec869cb94d730926ac5bd94ee0724e5bb8a94eb.exe	75

C:\Users\Admin\AppData\Local\Temp\9ec869cb94d730926ac5bd94ee0724e5bb8a94eb.exe
"C:\Users\Admin\AppData\Local\Temp\9ec869cb94d730926ac5bd94ee0724e5bb8a94eb.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:500
- C:\Users\Admin\AppData\Local\Temp\9ec869cb94d730926ac5bd94ee0724e5bb8a94eb.exe
  "C:\Users\Admin\AppData\Local\Temp\9ec869cb94d730926ac5bd94ee0724e5bb8a94eb.exe"
  2⤵
  PID:1344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/500-114-0x0000000000750000-0x00000000007FE000-memory.dmp

Filesize
696KB

Download