48ac37a414b973602d31d5db441c5095b5f7c977310cdad784efebac5bf9630d | Triage

Analysis

max time kernel
150s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08-11-2022 01:10

Sharing

Report Analysis Logs

General

Target

out15.exe
Size

72KB
MD5

971e7217c194ef2141557e2186559228
SHA1

049acf6590a689979b1d04cdfe36fbcc24af287b
SHA256

ea40bb474274c8ea7d030afd6b6d26f15993b20878857492d5eafe1c477c3650
SHA512

1e69d9f5cb15f707498ec198ac853171cb1830dfc9036a0b2f46f381b8223dec64ff4b491ba4284692bed9b1a97b46e429f94ecd439467088f9eff26653664af
SSDEEP

1536:IAdTXVGK+HF+dtpsVq7OpIg4t0BMb+KR0Nc8QsJq39:zOZ+eqKpIn0Be0Nc8QsC9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

out15.exe

description	pid	process	target process
PID 340 wrote to memory of 1732	340	out15.exe	calc.exe
PID 340 wrote to memory of 1732	340	out15.exe	calc.exe
PID 340 wrote to memory of 1732	340	out15.exe	calc.exe
PID 340 wrote to memory of 1732	340	out15.exe	calc.exe

C:\Users\Admin\AppData\Local\Temp\out15.exe
"C:\Users\Admin\AppData\Local\Temp\out15.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:340

C:\Windows\SysWOW64\calc.exe
calc.exe
2⤵
PID:1732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1732-54-0x0000000000000000-mapping.dmp

Download
memory/1732-55-0x0000000075771000-0x0000000075773000-memory.dmp

Filesize
8KB

Download