Analysis

  • max time kernel
    37s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    02-11-2022 20:25

General

  • Target

    012196b352ac6bb3f8791f1fa2164682476d16dc6c6a84531093edcf6eacd31a.exe

  • Size

    302KB

  • MD5

    311f1501f1de06dac2cf6728bf664b48

  • SHA1

    3f1efef35f2de4f4442cc19cc286d135bd39dc79

  • SHA256

    012196b352ac6bb3f8791f1fa2164682476d16dc6c6a84531093edcf6eacd31a

  • SHA512

    7896967c674ea5fe4c27672126d1dcc85a1deab384fa73c75ac875c53a07204d8c0334ff7bf6b3947a2dd7b1f7515d9f45a78ead9b9165872d7d8b740b51582d

  • SSDEEP

    6144:Pi8f+BLtABPDB45GpreKpwSURfa+suohnsgpUA1e04PaZ:PH4sVKSURfaCg91e/a

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\012196b352ac6bb3f8791f1fa2164682476d16dc6c6a84531093edcf6eacd31a.exe
    "C:\Users\Admin\AppData\Local\Temp\012196b352ac6bb3f8791f1fa2164682476d16dc6c6a84531093edcf6eacd31a.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1968
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c pause
      2⤵
        PID:952

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/952-54-0x0000000000000000-mapping.dmp