Analysis

  • max time kernel
    36s
  • max time network
    41s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    30/10/2022, 19:31

General

  • Target

    1748b6000c9014e8f352fc7004b78e3f95fc18b9623e99dc038f4943d5b486bb.exe

  • Size

    253KB

  • MD5

    83724708990daa56901dcc84c17c1ba1

  • SHA1

    17541ae2f8f694020da93a9eb38664134e4d40f5

  • SHA256

    1748b6000c9014e8f352fc7004b78e3f95fc18b9623e99dc038f4943d5b486bb

  • SHA512

    63fccdc70b363314ab429857d6a54e29893392e5f5404346d4cd7cd7d42366fd1755864512af311e27425e7b4565c76c6dc4cbcef0102e672300f5a40309867f

  • SSDEEP

    6144:hnpAOgw8HYWO9CyfVIqJ4TOP39UVA1zAvgdz9BrCoz6/UXOfRu:hnpH4HYWO9mM4TO/JWvg5rCL/U+fRu

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1268
      • C:\Users\Admin\AppData\Local\Temp\1748b6000c9014e8f352fc7004b78e3f95fc18b9623e99dc038f4943d5b486bb.exe
        "C:\Users\Admin\AppData\Local\Temp\1748b6000c9014e8f352fc7004b78e3f95fc18b9623e99dc038f4943d5b486bb.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1148

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1148-54-0x0000000000430000-0x000000000046D000-memory.dmp

            Filesize

            244KB

          • memory/1148-55-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/1148-56-0x0000000001DC1000-0x0000000001DC5000-memory.dmp

            Filesize

            16KB

          • memory/1148-57-0x0000000001DD0000-0x0000000001ED0000-memory.dmp

            Filesize

            1024KB

          • memory/1148-58-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/1148-59-0x0000000075041000-0x0000000075043000-memory.dmp

            Filesize

            8KB

          • memory/1148-63-0x0000000010000000-0x0000000010013000-memory.dmp

            Filesize

            76KB

          • memory/1148-64-0x0000000000430000-0x000000000046D000-memory.dmp

            Filesize

            244KB

          • memory/1268-60-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

            Filesize

            28KB