Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/10/2022, 22:13

General

  • Target

    a45cca644dabd14a7fe63d11de5a644383c355a6b0a74d8c4c78ef156aeb9c75.exe

  • Size

    251KB

  • MD5

    5013dc41000ffe080ce9ae429ecbad00

  • SHA1

    30cb14881a6b638f91c4c6d551a3571194c60185

  • SHA256

    a45cca644dabd14a7fe63d11de5a644383c355a6b0a74d8c4c78ef156aeb9c75

  • SHA512

    8875a2921c0d6180fa8924e82b244c8cffaeceb99c49a7737f4c454e7264e1650ff18376ee6c33885b6108f0ba7ed1f9491b134037f9a7e6ce82a9b0de3fd394

  • SSDEEP

    1536:Ev+1ajg59V5VsPW7AvosJe8k8hkKGCGL2+AbyTWOGIaNWUeCE1HMwnVdfevQ:A+4gru+7Avo/usFq+UCW1IaFEiwnVQQ

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a45cca644dabd14a7fe63d11de5a644383c355a6b0a74d8c4c78ef156aeb9c75.exe
    "C:\Users\Admin\AppData\Local\Temp\a45cca644dabd14a7fe63d11de5a644383c355a6b0a74d8c4c78ef156aeb9c75.exe"
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:764
    • C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      2⤵
        PID:4300

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/764-133-0x0000000000620000-0x0000000000633000-memory.dmp

      Filesize

      76KB

    • memory/764-134-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/764-137-0x0000000000400000-0x0000000000413000-memory.dmp

      Filesize

      76KB

    • memory/4300-135-0x0000000000940000-0x000000000094E000-memory.dmp

      Filesize

      56KB

    • memory/4300-136-0x0000000001240000-0x0000000001251000-memory.dmp

      Filesize

      68KB

    • memory/4300-138-0x0000000001840000-0x00000000018C0000-memory.dmp

      Filesize

      512KB

    • memory/4300-139-0x0000000001840000-0x00000000018C0000-memory.dmp

      Filesize

      512KB