48ac37a414b973602d31d5db441c5095b5f7c977310cdad784efebac5bf9630d | Triage

Analysis

max time kernel
147s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08-11-2022 01:10

Sharing

Report Analysis Logs

General

Target

out10.exe
Size

72KB
MD5

bc6a46e9f5e8569e07b0e9db822d2853
SHA1

ec05845cc65b30805f2ca4be8d68add3251407a2
SHA256

7d9415b6a84c8e60e15491eb3a1d9a2831682ae07f993ab46c0aa70377098320
SHA512

198741e0b69ca07e3a42688991bd1ba7ee334a4cb46c40817c0622483f672972320b6cd68372f03a70a94091ed3be762e24f119804a5fb432d7b81f0f2a04513
SSDEEP

1536:ICJA4PqtPVQ692z2DVL+CDTuMb+KR0Nc8QsJq39:WhPVQ692zQL5ue0Nc8QsC9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

out10.exe

description	pid	process	target process
PID 912 wrote to memory of 1284	912	out10.exe	calc.exe
PID 912 wrote to memory of 1284	912	out10.exe	calc.exe
PID 912 wrote to memory of 1284	912	out10.exe	calc.exe
PID 912 wrote to memory of 1284	912	out10.exe	calc.exe

C:\Users\Admin\AppData\Local\Temp\out10.exe
"C:\Users\Admin\AppData\Local\Temp\out10.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:912

C:\Windows\SysWOW64\calc.exe
calc.exe
2⤵
PID:1284

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1284-54-0x0000000000000000-mapping.dmp

Download
memory/1284-55-0x0000000075661000-0x0000000075663000-memory.dmp

Filesize
8KB

Download