Analysis
-
max time kernel
25s -
max time network
63s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 11:58
Static task
static1
Behavioral task
behavioral1
Sample
b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe
Resource
win10v2004-20220812-en
General
-
Target
b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe
-
Size
522KB
-
MD5
bcf62ae2067bdfd5f7868c47976a5956
-
SHA1
16dcf798a44a04c9f3d27c11b8a248778848b46a
-
SHA256
b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e
-
SHA512
6e62b4149ae029ef5123fb90df5bfa6e104fb28eb5fd4a33881685200e9db1e37d2342cc891a77b411c4ab7503e06ad5ca598f4bfb7b364a1a9a187ec5d5332b
-
SSDEEP
6144:ndw41YGU1Gi/n4aTjUz+CePSNTzn/0nww8i4IuwME0SONPmQy1CrxQqD9RSaSz+x:dbW9tyIwZi41wkvLy18xQqpx8O5G
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exedescription pid process target process PID 1300 wrote to memory of 1260 1300 b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe PID 1300 wrote to memory of 1260 1300 b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe PID 1300 wrote to memory of 1260 1300 b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe PID 1300 wrote to memory of 1260 1300 b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe PID 1300 wrote to memory of 1260 1300 b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe PID 1300 wrote to memory of 1260 1300 b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe PID 1300 wrote to memory of 1260 1300 b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe PID 1300 wrote to memory of 2032 1300 b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe PID 1300 wrote to memory of 2032 1300 b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe PID 1300 wrote to memory of 2032 1300 b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe PID 1300 wrote to memory of 2032 1300 b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe PID 1300 wrote to memory of 2032 1300 b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe PID 1300 wrote to memory of 2032 1300 b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe PID 1300 wrote to memory of 2032 1300 b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe"C:\Users\Admin\AppData\Local\Temp\b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exestart2⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\b2aef4cd198814a8685910217e50397b297793b2ec6dfce26fb877da8f42653e.exewatch2⤵PID:2032
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1260-60-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1260-57-0x0000000000000000-mapping.dmp
-
memory/1260-64-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1260-66-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1260-67-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1300-55-0x0000000075591000-0x0000000075593000-memory.dmpFilesize
8KB
-
memory/1300-58-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1300-54-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2032-56-0x0000000000000000-mapping.dmp
-
memory/2032-59-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2032-63-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2032-65-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2032-68-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB