Analysis
-
max time kernel
35s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 11:58
Static task
static1
Behavioral task
behavioral1
Sample
b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe
Resource
win10v2004-20220812-en
General
-
Target
b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe
-
Size
518KB
-
MD5
5af0463f6151510ca434372ac17cea7f
-
SHA1
61df7fa8d4998e3154ce4b0e81ecac95d72f9bdd
-
SHA256
b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3
-
SHA512
f795876d1acdd0ddc5893066f4a2710f18f71697627518f8387f3496b12fd8e028757dd6e32389c04fca136ac2500fc36e1daef6d2fbc4b4d35a134f46d5684f
-
SSDEEP
12288:QATwqGSP4LRFC2tr3lwYYlLPt5oKnWq360bl:QAAWqbNt2lLPt5/WCl
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exedescription pid process target process PID 912 wrote to memory of 1204 912 b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe PID 912 wrote to memory of 1204 912 b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe PID 912 wrote to memory of 1204 912 b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe PID 912 wrote to memory of 1204 912 b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe PID 912 wrote to memory of 1204 912 b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe PID 912 wrote to memory of 1204 912 b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe PID 912 wrote to memory of 1204 912 b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe PID 912 wrote to memory of 1272 912 b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe PID 912 wrote to memory of 1272 912 b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe PID 912 wrote to memory of 1272 912 b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe PID 912 wrote to memory of 1272 912 b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe PID 912 wrote to memory of 1272 912 b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe PID 912 wrote to memory of 1272 912 b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe PID 912 wrote to memory of 1272 912 b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe"C:\Users\Admin\AppData\Local\Temp\b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exestart2⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\b305dd903fc44cbd8271a22996c250d59ffc6c3217936dd3b6b1c3fa2c4afef3.exewatch2⤵PID:1272
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/912-54-0x0000000075661000-0x0000000075663000-memory.dmpFilesize
8KB
-
memory/912-57-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1204-56-0x0000000000000000-mapping.dmp
-
memory/1204-61-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1204-62-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1272-55-0x0000000000000000-mapping.dmp
-
memory/1272-60-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1272-63-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB