Analysis
-
max time kernel
35s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 09:07
Static task
static1
Behavioral task
behavioral1
Sample
e66e5ed3e5882cfd979f381be8a63498763739b0b58407679b1e303666b295c1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e66e5ed3e5882cfd979f381be8a63498763739b0b58407679b1e303666b295c1.exe
Resource
win10v2004-20220812-en
General
-
Target
e66e5ed3e5882cfd979f381be8a63498763739b0b58407679b1e303666b295c1.exe
-
Size
527KB
-
MD5
c1ed7aae24d7ca8eef52826c09ed4d2b
-
SHA1
ce74692ca2000b39a35baede2b278eef220d54b1
-
SHA256
e66e5ed3e5882cfd979f381be8a63498763739b0b58407679b1e303666b295c1
-
SHA512
f6c5bc0597b61a3b17829b9697ce15df0546c004d7cb896fc8f477dbdf82fbedd7add759895898610f2356e63619c9e6cab2d9710546212423e0c05fdd04423d
-
SSDEEP
12288:GWYXNT1JBQc8LRGnq1Hqsl1yZ/+d896BN:4ddQTGnqLeEs6BN
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
e66e5ed3e5882cfd979f381be8a63498763739b0b58407679b1e303666b295c1.exedescription pid process target process PID 1472 wrote to memory of 1392 1472 e66e5ed3e5882cfd979f381be8a63498763739b0b58407679b1e303666b295c1.exe e66e5ed3e5882cfd979f381be8a63498763739b0b58407679b1e303666b295c1.exe PID 1472 wrote to memory of 1392 1472 e66e5ed3e5882cfd979f381be8a63498763739b0b58407679b1e303666b295c1.exe e66e5ed3e5882cfd979f381be8a63498763739b0b58407679b1e303666b295c1.exe PID 1472 wrote to memory of 1392 1472 e66e5ed3e5882cfd979f381be8a63498763739b0b58407679b1e303666b295c1.exe e66e5ed3e5882cfd979f381be8a63498763739b0b58407679b1e303666b295c1.exe PID 1472 wrote to memory of 1392 1472 e66e5ed3e5882cfd979f381be8a63498763739b0b58407679b1e303666b295c1.exe e66e5ed3e5882cfd979f381be8a63498763739b0b58407679b1e303666b295c1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e66e5ed3e5882cfd979f381be8a63498763739b0b58407679b1e303666b295c1.exe"C:\Users\Admin\AppData\Local\Temp\e66e5ed3e5882cfd979f381be8a63498763739b0b58407679b1e303666b295c1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e66e5ed3e5882cfd979f381be8a63498763739b0b58407679b1e303666b295c1.exetear2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1392-56-0x0000000000000000-mapping.dmp
-
memory/1392-59-0x0000000000400000-0x000000000048D000-memory.dmpFilesize
564KB
-
memory/1392-60-0x0000000000400000-0x000000000048D000-memory.dmpFilesize
564KB
-
memory/1392-61-0x0000000000400000-0x000000000048D000-memory.dmpFilesize
564KB
-
memory/1472-54-0x0000000000400000-0x000000000048D000-memory.dmpFilesize
564KB
-
memory/1472-55-0x0000000074C11000-0x0000000074C13000-memory.dmpFilesize
8KB
-
memory/1472-57-0x0000000000400000-0x000000000048D000-memory.dmpFilesize
564KB