48ac37a414b973602d31d5db441c5095b5f7c977310cdad784efebac5bf9630d | Triage

Analysis

max time kernel
151s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08-11-2022 01:10

Sharing

Report Analysis Logs

General

Target

out21.exe
Size

72KB
MD5

9ef7fa437ae2c97ed78a4e688446ac3a
SHA1

7f6b0b04531927c58dfe0deed9090e1dee62b774
SHA256

c6d3166aa8bf663e3d3898cf3f59cfca5e7cf130fa881b010453327ee7f56679
SHA512

b60f62babaf13477a44794610f4a666576e04fc2e284815333b416021cd69a0917501ff15eb0ca834254f1e5402bc2e766489b8513aa21f157bb7a3cbe73cc80
SSDEEP

1536:Ipo4Djv3dUuLvlgSk2UEbVGf7HRR9szesGQQpHMb+KR0Nc8QsJq39:sXvZ6SksUf7xSeFpHe0Nc8QsC9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

out21.exe

description	pid	process	target process
PID 1688 wrote to memory of 1044	1688	out21.exe	calc.exe
PID 1688 wrote to memory of 1044	1688	out21.exe	calc.exe
PID 1688 wrote to memory of 1044	1688	out21.exe	calc.exe
PID 1688 wrote to memory of 1044	1688	out21.exe	calc.exe

C:\Users\Admin\AppData\Local\Temp\out21.exe
"C:\Users\Admin\AppData\Local\Temp\out21.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\calc.exe
calc.exe
2⤵
PID:1044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1044-54-0x0000000000000000-mapping.dmp

Download
memory/1044-55-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download