b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967

Analysis

max time kernel
45s
max time network
57s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe
Size

526KB
MD5

996d18c0d1badcb43d4b2f14b70279eb
SHA1

7b0642e68282a7751250650f82ed9af9eb3275b8
SHA256

b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967
SHA512

83683e2874844f1fd94ab54036b80937298d693758c1683ce335e63c943d57e50b67a30ebac9dc13ee9ab653553ce7e83b0a90e652c849041b02534ef159f3ea
SSDEEP

12288:sUglNXMpObvp017MBfuEaCzxo4xUupSMrFCsNEfF4SaS:sXbN5fuiG4quouFCsNaHaS

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe

description	pid	process	target process
PID 1732 wrote to memory of 824	1732	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe
PID 1732 wrote to memory of 824	1732	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe
PID 1732 wrote to memory of 824	1732	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe
PID 1732 wrote to memory of 824	1732	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe
PID 1732 wrote to memory of 824	1732	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe
PID 1732 wrote to memory of 824	1732	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe
PID 1732 wrote to memory of 824	1732	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe
PID 1732 wrote to memory of 1124	1732	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe
PID 1732 wrote to memory of 1124	1732	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe
PID 1732 wrote to memory of 1124	1732	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe
PID 1732 wrote to memory of 1124	1732	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe
PID 1732 wrote to memory of 1124	1732	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe
PID 1732 wrote to memory of 1124	1732	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe
PID 1732 wrote to memory of 1124	1732	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe

C:\Users\Admin\AppData\Local\Temp\b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe
"C:\Users\Admin\AppData\Local\Temp\b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1732

C:\Users\Admin\AppData\Local\Temp\b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe
start
2⤵
PID:824

C:\Users\Admin\AppData\Local\Temp\b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe
watch
2⤵
PID:1124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/824-56-0x0000000000000000-mapping.dmp

Download
memory/824-60-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/824-62-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1124-55-0x0000000000000000-mapping.dmp

Download
memory/1124-61-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1124-63-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1732-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1732-57-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download