48ac37a414b973602d31d5db441c5095b5f7c977310cdad784efebac5bf9630d | Triage

Analysis

max time kernel
147s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
08-11-2022 01:10

Sharing

Report Analysis Logs

General

Target

out16.exe
Size

72KB
MD5

493e7a35a761f837e4ee2f984028ca3c
SHA1

b0ce5076a7861cce6b338ee083585558f2b142b7
SHA256

c2bc187d302d29e25dacd8034ca1dce97ea3b547c6a3d0087adfca31c618d519
SHA512

97f234277ad455ad8b3e3f85b67f23347be326349725f84af0b26312c7d48405b81de6be93b1c336f75bf6dc4ea16388193e532aba081f3fb5bac40344b94947
SSDEEP

1536:ISvUp/wvrZKMIqb2g9no6qofPWr6Mb+KR0Nc8QsJq39:HvKwtqqb2knJJU6e0Nc8QsC9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

out16.exe

description	pid	process	target process
PID 1768 wrote to memory of 1112	1768	out16.exe	calc.exe
PID 1768 wrote to memory of 1112	1768	out16.exe	calc.exe
PID 1768 wrote to memory of 1112	1768	out16.exe	calc.exe
PID 1768 wrote to memory of 1112	1768	out16.exe	calc.exe

C:\Users\Admin\AppData\Local\Temp\out16.exe
"C:\Users\Admin\AppData\Local\Temp\out16.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1768

C:\Windows\SysWOW64\calc.exe
calc.exe
2⤵
PID:1112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1112-54-0x0000000000000000-mapping.dmp

Download
memory/1112-55-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download