8a227b80714a2ee25f04541f20c7bcee3063d96541dde42e9c99523e2cd74341

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/11/2022, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 12.1MB
Sample221111-cb476aaber
SHA256 8a227b80714a2ee25f04541f20c7bcee3063d96541dde42e9c99523e2cd74341
MD5 19b20fc498d366730c470bacab083fe7
SHA1 9d63950c73423991e2884392bc9682d836f9e031
SHA512 0c03e865381fab1e06b2c42f70a3183bd96b06eaa6524f9d254ff708859b89c92a5f7c7186c84888bd543ad1cbf3d45ca4125acdaec059751e9ba2097f90dedb
SSDEEP 196608:8ZhuxUqr8arjzvp/lrMbq/zJhgRCyy8vMXkixKV8UrAPcADUXpmCt3Fe:ChSUs3rHx/lQbq7oTy8mkiICU0nAX73Q
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1800	file.tmp

Loads dropped DLL 2 IoCs

pid	Process
1184	file.exe
1800	file.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 1800	1184	file.exe	26
PID 1184 wrote to memory of 1800	1184	file.exe	26
PID 1184 wrote to memory of 1800	1184	file.exe	26
PID 1184 wrote to memory of 1800	1184	file.exe	26
PID 1184 wrote to memory of 1800	1184	file.exe	26
PID 1184 wrote to memory of 1800	1184	file.exe	26
PID 1184 wrote to memory of 1800	1184	file.exe	26

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Users\Admin\AppData\Local\Temp\is-RP5A9.tmp\file.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-RP5A9.tmp\file.tmp" /SL5="$60122,11860388,791040,C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

file.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-RP5A9.tmp\file.tmp
Size 3.0MB
SHA256 25c367da28a2e61834bbaeed1a594a0ca1e377a8c27215c9ad6ac5d97f671b8b
MD5 64f68f0b5364a0313ef5c2ede5feac47
SHA1 00ad3dab6e7906ba79ba23ee43809430ed7901b4
SHA512 75586a619f9dc618652d62849c7de840faf83378adbb78572a342807b2749628fd0baaea79e16124cac5f82aa49bc9f77274af039cd7d52885cc655235658de1
SSDEEP 49152:UEA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTVc3338r:E92bz2Eb6pd7B6bAGx7u333s
MD5 SHA1 SHA512 SSDEEP

Submit Download

PEInjector.dll

Path \Users\Admin\AppData\Local\Temp\is-F03KL.tmp\PEInjector.dll
Size 186KB
SHA256 9e371a745ea2c92c4ba996772557f4a66545ed5186d02bb2e73e20dc79906ec7
MD5 a4cf124b21795dfd382c12422fd901ca
SHA1 7e2832f3b8b8e06ae594558d81416e96a81d3898
SHA512 3ee82d438e4a01d543791a6a17d78e148a68796e5f57d7354da36da0755369091089466e57ee9b786e7e0305a4321c281e03aeb24f6eb4dd07e7408eb3763cdd
SSDEEP 3072:GHYbm1i+GQ/kUopeW6ZuWUBQJwREy1mN1DX7JxAg0FujtI4U42B/mPnX:uDvkUppZu/8oZ1+AO32YPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

file.tmp

Path \Users\Admin\AppData\Local\Temp\is-RP5A9.tmp\file.tmp
Size 3.0MB
SHA256 25c367da28a2e61834bbaeed1a594a0ca1e377a8c27215c9ad6ac5d97f671b8b
MD5 64f68f0b5364a0313ef5c2ede5feac47
SHA1 00ad3dab6e7906ba79ba23ee43809430ed7901b4
SHA512 75586a619f9dc618652d62849c7de840faf83378adbb78572a342807b2749628fd0baaea79e16124cac5f82aa49bc9f77274af039cd7d52885cc655235658de1
SSDEEP 49152:UEA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTVc3338r:E92bz2Eb6pd7B6bAGx7u333s
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1184-54-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

Download

memory/1184-55-0x0000000000400000-0x00000000004CE000-memory.dmp

Download

memory/1184-61-0x0000000000400000-0x00000000004CE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads