fa9ad80c0977cdbfe8419d27ca9ad909d34f1737df726f4d175f6b85b0670074

Analysis

max time kernel
84s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2022, 20:38

Target

2018-05-16-Trickbot-malware-binary.exe
Size

166KB
MD5

96985dff8be2912fe2d02752b5d4a073
SHA1

483d8c1e2dfe671eda6dea2fe11ab8a54f8ca0a1
SHA256

fa9ad80c0977cdbfe8419d27ca9ad909d34f1737df726f4d175f6b85b0670074
SHA512

3dd52536daa896efdaca8ccfc0d5e45a0f271c74b8a55762386408a6308201d502e29f40dd6481522028051c07c0f00abbf103543afe5196af1a0a3220b54d7c
SSDEEP

3072:Rbx/OZbql/eMRiVUV0g0bHV6h/ke1zEpq4KaxnD9RRUQ5l/MQ85Cw5suN:RufEi2V05rVe8eJUq4Ka1RUQT0QgCwO+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 1376	4984	2018-05-16-Trickbot-malware-binary.exe	84
PID 4984 wrote to memory of 1376	4984	2018-05-16-Trickbot-malware-binary.exe	84
PID 4984 wrote to memory of 1376	4984	2018-05-16-Trickbot-malware-binary.exe	84

C:\Users\Admin\AppData\Local\Temp\2018-05-16-Trickbot-malware-binary.exe
"C:\Users\Admin\AppData\Local\Temp\2018-05-16-Trickbot-malware-binary.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Users\Admin\AppData\Local\Temp\2018-05-16-Trickbot-malware-binary.exe
  "C:\Users\Admin\AppData\Local\Temp\2018-05-16-Trickbot-malware-binary.exe"
  2⤵
  PID:1376