48ac37a414b973602d31d5db441c5095b5f7c977310cdad784efebac5bf9630d | Triage

Analysis

max time kernel
150s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08-11-2022 01:10

Sharing

Report Analysis Logs

General

Target

out18.exe
Size

72KB
MD5

7c569fc6edbb4818190c2fc6ce2cf8b4
SHA1

7aeb0a83f442a57646b43f451048da1135a6fa7a
SHA256

0622de553b2afdc9f204554bddaf51213c0bdfe38dafd390f69c6d83e114b7c8
SHA512

47055ee5971fd4ef2027b274d623c90762f62df5c45d429bfff53ef24a2966a3423b4aadb347b1a4d36fed9ec65da8b94fc47b65c847d65c6f1be1ac656a9ac3
SSDEEP

1536:IZXZfVeEafMQA6+kxPtZmcd53Hju/YxMb+KR0Nc8QsJq39:4ZfsAQPb/Fe0Nc8QsC9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

out18.exe

description	pid	process	target process
PID 1720 wrote to memory of 1580	1720	out18.exe	calc.exe
PID 1720 wrote to memory of 1580	1720	out18.exe	calc.exe
PID 1720 wrote to memory of 1580	1720	out18.exe	calc.exe
PID 1720 wrote to memory of 1580	1720	out18.exe	calc.exe

C:\Users\Admin\AppData\Local\Temp\out18.exe
"C:\Users\Admin\AppData\Local\Temp\out18.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1720

C:\Windows\SysWOW64\calc.exe
calc.exe
2⤵
PID:1580

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1580-54-0x0000000000000000-mapping.dmp

Download
memory/1580-55-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download