Analysis
-
max time kernel
146s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 11:54
Static task
static1
Behavioral task
behavioral1
Sample
cd3afdc575ff1cb5ffb05da525ea4ee4eb466cf09df02caddd55ab5645537718.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
cd3afdc575ff1cb5ffb05da525ea4ee4eb466cf09df02caddd55ab5645537718.exe
Resource
win10v2004-20220812-en
General
-
Target
cd3afdc575ff1cb5ffb05da525ea4ee4eb466cf09df02caddd55ab5645537718.exe
-
Size
522KB
-
MD5
2325227808936a81716486941c914acd
-
SHA1
2bff5d8ba602acbecc178c28e6488496000f1f88
-
SHA256
cd3afdc575ff1cb5ffb05da525ea4ee4eb466cf09df02caddd55ab5645537718
-
SHA512
4bda0849cc62da8258de79e8e08ac431c1277793d30d2b2b7644ae5a7f56126dbd44876e054f600b7b135e4584bb497a94d7c1d6002e69a6e49a685e9704d65e
-
SSDEEP
6144:D0QSsN7gczh7fnz71BbmFi3Eu2Ww3xGVuwejp6DmQy1CrxQqD9RSaSz+8O5AOg:g8Ncw777+EUu2zSVSpgy18xQqpx8O5A
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
cd3afdc575ff1cb5ffb05da525ea4ee4eb466cf09df02caddd55ab5645537718.exedescription pid process target process PID 4800 wrote to memory of 448 4800 cd3afdc575ff1cb5ffb05da525ea4ee4eb466cf09df02caddd55ab5645537718.exe cd3afdc575ff1cb5ffb05da525ea4ee4eb466cf09df02caddd55ab5645537718.exe PID 4800 wrote to memory of 448 4800 cd3afdc575ff1cb5ffb05da525ea4ee4eb466cf09df02caddd55ab5645537718.exe cd3afdc575ff1cb5ffb05da525ea4ee4eb466cf09df02caddd55ab5645537718.exe PID 4800 wrote to memory of 448 4800 cd3afdc575ff1cb5ffb05da525ea4ee4eb466cf09df02caddd55ab5645537718.exe cd3afdc575ff1cb5ffb05da525ea4ee4eb466cf09df02caddd55ab5645537718.exe PID 4800 wrote to memory of 2256 4800 cd3afdc575ff1cb5ffb05da525ea4ee4eb466cf09df02caddd55ab5645537718.exe cd3afdc575ff1cb5ffb05da525ea4ee4eb466cf09df02caddd55ab5645537718.exe PID 4800 wrote to memory of 2256 4800 cd3afdc575ff1cb5ffb05da525ea4ee4eb466cf09df02caddd55ab5645537718.exe cd3afdc575ff1cb5ffb05da525ea4ee4eb466cf09df02caddd55ab5645537718.exe PID 4800 wrote to memory of 2256 4800 cd3afdc575ff1cb5ffb05da525ea4ee4eb466cf09df02caddd55ab5645537718.exe cd3afdc575ff1cb5ffb05da525ea4ee4eb466cf09df02caddd55ab5645537718.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd3afdc575ff1cb5ffb05da525ea4ee4eb466cf09df02caddd55ab5645537718.exe"C:\Users\Admin\AppData\Local\Temp\cd3afdc575ff1cb5ffb05da525ea4ee4eb466cf09df02caddd55ab5645537718.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\cd3afdc575ff1cb5ffb05da525ea4ee4eb466cf09df02caddd55ab5645537718.exestart2⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\cd3afdc575ff1cb5ffb05da525ea4ee4eb466cf09df02caddd55ab5645537718.exewatch2⤵PID:2256
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/448-134-0x0000000000000000-mapping.dmp
-
memory/448-137-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/448-139-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/448-140-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2256-133-0x0000000000000000-mapping.dmp
-
memory/2256-136-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2256-138-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2256-141-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4800-132-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4800-135-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB