b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710

Analysis

max time kernel
58s
max time network
89s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe
Size

522KB
MD5

5283758c54fe2e5df8ea82fef98eca1a
SHA1

ce51485b6b5c5f71bd492c1661ccce5b9b14d7cd
SHA256

b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710
SHA512

5c8670e84ad16b51cd58bc8b5f87535e28f8fecd4aeee86c0a1a1f2816e0dc64accc0ff0f4bb207a83f72c2304c81d18aefe118bd726305f6807a75ac8ef2efe
SSDEEP

6144:oAbdBy9QLr0ua8vixp/zBu/+OkJYvkch0FZdDADKQFGUSbAeIMtmQy1CrxQqD9Rs:7BTk9Mwww6/DXFEbAkvy18xQqpx8O5I

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe

description	pid	process	target process
PID 1812 wrote to memory of 1284	1812	b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe	b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe
PID 1812 wrote to memory of 1284	1812	b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe	b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe
PID 1812 wrote to memory of 1284	1812	b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe	b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe
PID 1812 wrote to memory of 1284	1812	b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe	b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe
PID 1812 wrote to memory of 1284	1812	b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe	b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe
PID 1812 wrote to memory of 1284	1812	b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe	b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe
PID 1812 wrote to memory of 1284	1812	b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe	b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe
PID 1812 wrote to memory of 676	1812	b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe	b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe
PID 1812 wrote to memory of 676	1812	b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe	b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe
PID 1812 wrote to memory of 676	1812	b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe	b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe
PID 1812 wrote to memory of 676	1812	b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe	b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe
PID 1812 wrote to memory of 676	1812	b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe	b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe
PID 1812 wrote to memory of 676	1812	b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe	b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe
PID 1812 wrote to memory of 676	1812	b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe	b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe

C:\Users\Admin\AppData\Local\Temp\b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe
"C:\Users\Admin\AppData\Local\Temp\b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1812

C:\Users\Admin\AppData\Local\Temp\b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe
start
2⤵
PID:1284

C:\Users\Admin\AppData\Local\Temp\b028d688bbf1b331cf37a38fe7ba7492d18623f95407234f597ba8e6e5b71710.exe
watch
2⤵
PID:676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/676-59-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/676-69-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/676-56-0x0000000000000000-mapping.dmp

Download
memory/676-65-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/676-63-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1284-57-0x0000000000000000-mapping.dmp

Download
memory/1284-60-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1284-64-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1284-66-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1284-67-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1284-68-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1812-58-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1812-54-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1812-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download