Analysis
-
max time kernel
58s -
max time network
98s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 11:59
Static task
static1
Behavioral task
behavioral1
Sample
a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe
Resource
win10v2004-20221111-en
General
-
Target
a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe
-
Size
522KB
-
MD5
89de56fb1da61fe811c399f026030a90
-
SHA1
421a2cb2b77b5618b732459def6697e9970ab918
-
SHA256
a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5
-
SHA512
37b81bee53f3cd67df76b824f16d3e8c82a356bd5fc11b5ba4b9b08c92845aa238d5e9d9fdbf9bb144dd3651333aeed98f7c3c4a8bd5ed2714d856c40ee7558c
-
SSDEEP
6144:GeR3DXvWqQrRnr7Kaj/QBeB6XUYa77StUjXUy0bRqmQy1CrxQqD9RSaSz+8O594V:hdeJQB7XUhetyN3y18xQqpx8O59
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exedescription pid process target process PID 1108 wrote to memory of 1196 1108 a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe PID 1108 wrote to memory of 1196 1108 a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe PID 1108 wrote to memory of 1196 1108 a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe PID 1108 wrote to memory of 1196 1108 a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe PID 1108 wrote to memory of 1196 1108 a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe PID 1108 wrote to memory of 1196 1108 a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe PID 1108 wrote to memory of 1196 1108 a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe PID 1108 wrote to memory of 268 1108 a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe PID 1108 wrote to memory of 268 1108 a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe PID 1108 wrote to memory of 268 1108 a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe PID 1108 wrote to memory of 268 1108 a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe PID 1108 wrote to memory of 268 1108 a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe PID 1108 wrote to memory of 268 1108 a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe PID 1108 wrote to memory of 268 1108 a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe"C:\Users\Admin\AppData\Local\Temp\a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exestart2⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exewatch2⤵PID:268
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/268-64-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/268-56-0x0000000000000000-mapping.dmp
-
memory/268-69-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/268-60-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/268-67-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1108-55-0x0000000075A91000-0x0000000075A93000-memory.dmpFilesize
8KB
-
memory/1108-58-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1108-54-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1196-59-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1196-65-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1196-66-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1196-62-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1196-68-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1196-57-0x0000000000000000-mapping.dmp