Analysis

  • max time kernel
    144s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-11-2022 04:49

General

  • Target

    d1fbe2fa868d0f9cae9579cbd9f75a324955de6a7458e692b318c19dddea4b15.exe

  • Size

    130KB

  • MD5

    224d101467cffc0981102708e3e6c3d0

  • SHA1

    484f58635cfbf01c82e40bed9a798dc009889ed7

  • SHA256

    d1fbe2fa868d0f9cae9579cbd9f75a324955de6a7458e692b318c19dddea4b15

  • SHA512

    10a8be61118a46ea910b7e7d5913d1b4ef90b07bad8a8da0510de595229768fe03c73d7526e8a9ac88271d62494a4f4fefc3dea11823fcd6e87c6ed62a508255

  • SSDEEP

    3072:I3N8m6Kt/lL2jpNu1nLX9ljjjjjjjjjcSxm85yi7JR:ytwju1nLFxm8

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d1fbe2fa868d0f9cae9579cbd9f75a324955de6a7458e692b318c19dddea4b15.exe
    "C:\Users\Admin\AppData\Local\Temp\d1fbe2fa868d0f9cae9579cbd9f75a324955de6a7458e692b318c19dddea4b15.exe"
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:3368
    • C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      2⤵
        PID:4324

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3368-133-0x00000000006F0000-0x0000000000703000-memory.dmp

      Filesize

      76KB

    • memory/3368-134-0x0000000000400000-0x0000000000413000-memory.dmp

      Filesize

      76KB

    • memory/4324-135-0x00000000005B0000-0x00000000005BE000-memory.dmp

      Filesize

      56KB

    • memory/4324-136-0x0000000000D30000-0x0000000000D41000-memory.dmp

      Filesize

      68KB

    • memory/4324-137-0x0000000001550000-0x00000000015D0000-memory.dmp

      Filesize

      512KB