5645519db8b96eb738ef36c10d8eba150a2c19a13592d0e8ea5e57f64e43b4fb | Triage

Analysis

max time kernel
38s
max time network
46s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
25-07-2022 04:29

Sharing

Report Analysis Logs

General

Target

5645519db8b96eb738ef36c10d8eba150a2c19a13592d0e8ea5e57f64e43b4fb.exe
Size

388KB
MD5

ef2c7bf69513cf30d5320579df36d8f3
SHA1

43443365284476e3b3744b37bcf835340c93fcfe
SHA256

5645519db8b96eb738ef36c10d8eba150a2c19a13592d0e8ea5e57f64e43b4fb
SHA512

97e5bf3d030aef21ed0ab0107fa73ac6057aa48dcd14e30b53452dc95e0a365b5d9a859751412f3a074217c687f479147daa0ed23c056569b3388d9fc31d8bfd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

5645519db8b96eb738ef36c10d8eba150a2c19a13592d0e8ea5e57f64e43b4fb.exe

description	pid	process	target process
PID 1320 wrote to memory of 536	1320	5645519db8b96eb738ef36c10d8eba150a2c19a13592d0e8ea5e57f64e43b4fb.exe	RegAsm.exe
PID 1320 wrote to memory of 536	1320	5645519db8b96eb738ef36c10d8eba150a2c19a13592d0e8ea5e57f64e43b4fb.exe	RegAsm.exe
PID 1320 wrote to memory of 536	1320	5645519db8b96eb738ef36c10d8eba150a2c19a13592d0e8ea5e57f64e43b4fb.exe	RegAsm.exe
PID 1320 wrote to memory of 536	1320	5645519db8b96eb738ef36c10d8eba150a2c19a13592d0e8ea5e57f64e43b4fb.exe	RegAsm.exe
PID 1320 wrote to memory of 536	1320	5645519db8b96eb738ef36c10d8eba150a2c19a13592d0e8ea5e57f64e43b4fb.exe	RegAsm.exe
PID 1320 wrote to memory of 536	1320	5645519db8b96eb738ef36c10d8eba150a2c19a13592d0e8ea5e57f64e43b4fb.exe	RegAsm.exe
PID 1320 wrote to memory of 536	1320	5645519db8b96eb738ef36c10d8eba150a2c19a13592d0e8ea5e57f64e43b4fb.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\5645519db8b96eb738ef36c10d8eba150a2c19a13592d0e8ea5e57f64e43b4fb.exe
"C:\Users\Admin\AppData\Local\Temp\5645519db8b96eb738ef36c10d8eba150a2c19a13592d0e8ea5e57f64e43b4fb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1320

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
2⤵
PID:536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1320-54-0x0000000075D51000-0x0000000075D53000-memory.dmp

Filesize
8KB

Download
memory/1320-55-0x0000000075010000-0x00000000755BB000-memory.dmp

Filesize
5.7MB

Download