Analysis
-
max time kernel
178s -
max time network
197s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 11:59
Static task
static1
Behavioral task
behavioral1
Sample
a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe
Resource
win10v2004-20221111-en
General
-
Target
a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe
-
Size
522KB
-
MD5
89de56fb1da61fe811c399f026030a90
-
SHA1
421a2cb2b77b5618b732459def6697e9970ab918
-
SHA256
a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5
-
SHA512
37b81bee53f3cd67df76b824f16d3e8c82a356bd5fc11b5ba4b9b08c92845aa238d5e9d9fdbf9bb144dd3651333aeed98f7c3c4a8bd5ed2714d856c40ee7558c
-
SSDEEP
6144:GeR3DXvWqQrRnr7Kaj/QBeB6XUYa77StUjXUy0bRqmQy1CrxQqD9RSaSz+8O594V:hdeJQB7XUhetyN3y18xQqpx8O59
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exedescription pid process target process PID 4748 wrote to memory of 5108 4748 a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe PID 4748 wrote to memory of 5108 4748 a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe PID 4748 wrote to memory of 5108 4748 a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe PID 4748 wrote to memory of 2716 4748 a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe PID 4748 wrote to memory of 2716 4748 a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe PID 4748 wrote to memory of 2716 4748 a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe"C:\Users\Admin\AppData\Local\Temp\a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exestart2⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\a91cc2a2981a44d28ad165e0bf9677374497e7f68d22de59e72dd82c6a4c2ab5.exewatch2⤵PID:2716
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2716-134-0x0000000000000000-mapping.dmp
-
memory/2716-137-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2716-140-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2716-142-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4748-132-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4748-133-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4748-136-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/5108-135-0x0000000000000000-mapping.dmp
-
memory/5108-138-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/5108-139-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/5108-141-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB