1485ef0c179d60a8a62731bcfaf6e14e519becf479300223cca3be415d723e1d | Triage

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-en-20211208
submitted
10-02-2022 21:59

Sharing

Report Analysis Logs

General

Target

1.exe
Size

19.4MB
MD5

6a58b52b184715583cda792b56a0a1ed
SHA1

3477a173e2c1005a81d042802ab0f22cc12a4d55
SHA256

d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb
SHA512

49ee746a98bce076cd20a36d57d08ed0dc39d48a0a2866173d4c0dbb1633e2ec8e069f4dbba578e707c8dd1de1fcc908cf412e4a9fff9ecc78ac92357e75c313

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2028	1.tmp

Loads dropped DLL 4 IoCs

pid	Process
812	1.exe
2028	1.tmp
2028	1.tmp
2028	1.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2028	1.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 2028	812	1.exe	27
PID 812 wrote to memory of 2028	812	1.exe	27
PID 812 wrote to memory of 2028	812	1.exe	27
PID 812 wrote to memory of 2028	812	1.exe	27
PID 812 wrote to memory of 2028	812	1.exe	27
PID 812 wrote to memory of 2028	812	1.exe	27
PID 812 wrote to memory of 2028	812	1.exe	27

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:812
- C:\Users\Admin\AppData\Local\Temp\is-7K4F4.tmp\1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-7K4F4.tmp\1.tmp" /SL5="$4014E,19769177,139776,C:\Users\Admin\AppData\Local\Temp\1.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/812-55-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Filesize
8KB

Download
memory/812-56-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/812-58-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/2028-62-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download