54e7eb310fbba8c3ad41bb284180f9839cd4a2436da36b33404fc04460c449a8 | Triage

Analysis

max time kernel
43s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
31-08-2022 08:52

Sharing

Report Analysis Logs

General

Target

WMI.exe
Size

3.0MB
MD5

676758f128778998528135577dff284b
SHA1

54e7047afa90e0b559a2eae17f77148c643b3203
SHA256

54e7eb310fbba8c3ad41bb284180f9839cd4a2436da36b33404fc04460c449a8
SHA512

c7e866bc0e57b5ca10166c086e1e7f14a15f25c5f13862e1d64d712a9ce06da83690465a9bc0891fc6e4413b0ffde3004efe42a4e178a58a15b23fd623e9ab3c
SSDEEP

49152:F7ckrHpr8vDS5gEgwccVym0LWN/giMhiYB1N03mcwR3J:h5rH6OiEgGh0s7MhB1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2028	1728	control.exe	28
PID 1728 wrote to memory of 2028	1728	control.exe	28
PID 1728 wrote to memory of 2028	1728	control.exe	28

C:\Users\Admin\AppData\Local\Temp\WMI.exe
"C:\Users\Admin\AppData\Local\Temp\WMI.exe"
1⤵
PID:1972

C:\Windows\System32\control.exe
"C:\Windows\System32\control.exe" "C:\Windows\system32\ncpa.cpl",
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\system32\ncpa.cpl",
  2⤵
  PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1728-55-0x000007FEFB941000-0x000007FEFB943000-memory.dmp

Filesize
8KB

Download
memory/1972-54-0x00000000761A1000-0x00000000761A3000-memory.dmp

Filesize
8KB

Download