Analysis

  • max time kernel
    43s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 09:07

General

  • Target

    44ed0b985c81033b4c0f263a8bbb75a105802e1ced02318317ccc26c4aad35f9.exe

  • Size

    527KB

  • MD5

    25a1a1b19384dc86d39c505ba60551e4

  • SHA1

    446fac59615e15388020c4bdd5ed833100258192

  • SHA256

    44ed0b985c81033b4c0f263a8bbb75a105802e1ced02318317ccc26c4aad35f9

  • SHA512

    f6f345b87ee00b91decf5b603fcc603e7da1cdd241ec3091da0f752d7f54de43a40daccc24e6a19621befd7a76ac8fb610d8b8f9de2a2be54dcd7b3576be68d0

  • SSDEEP

    12288:0VJKXta/in8D3p/nq1Hqsl1yZ/+d81yWZ:0zJ/ino3p/nqLeEEyWZ

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\44ed0b985c81033b4c0f263a8bbb75a105802e1ced02318317ccc26c4aad35f9.exe
    "C:\Users\Admin\AppData\Local\Temp\44ed0b985c81033b4c0f263a8bbb75a105802e1ced02318317ccc26c4aad35f9.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1212
    • C:\Users\Admin\AppData\Local\Temp\44ed0b985c81033b4c0f263a8bbb75a105802e1ced02318317ccc26c4aad35f9.exe
      tear
      2⤵
        PID:1224

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1212-54-0x0000000076711000-0x0000000076713000-memory.dmp
      Filesize

      8KB

    • memory/1212-56-0x0000000000400000-0x000000000048D000-memory.dmp
      Filesize

      564KB

    • memory/1224-55-0x0000000000000000-mapping.dmp
    • memory/1224-58-0x0000000000400000-0x000000000048D000-memory.dmp
      Filesize

      564KB

    • memory/1224-59-0x0000000000400000-0x000000000048D000-memory.dmp
      Filesize

      564KB