aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a

Analysis

max time kernel
42s
max time network
82s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe
Size

522KB
MD5

3d3a43cbfd169bcb0d21f9cc6ed904e2
SHA1

f968e1dc9638e50a508795e265eb037f213365b9
SHA256

aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a
SHA512

1d0a5ada165313aaec30002f8b4ea92454d985ae2d6f9568ba4db5a5d305e4f94be5b2c529c90c80ebc5a3b0dcebad38d2c02bc71fbfd9f1e65f5bce8aba6ede
SSDEEP

6144:pUi8YVAnOl86HLijp02Zb21HiwodmPCGl5yDyzOmQy1CrxQqD9RSaSz+8O5yl:382nGr5ZmPyy18xQqpx8O5y

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe

description	pid	process	target process
PID 1716 wrote to memory of 1976	1716	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe
PID 1716 wrote to memory of 1976	1716	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe
PID 1716 wrote to memory of 1976	1716	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe
PID 1716 wrote to memory of 1976	1716	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe
PID 1716 wrote to memory of 1976	1716	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe
PID 1716 wrote to memory of 1976	1716	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe
PID 1716 wrote to memory of 1976	1716	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe
PID 1716 wrote to memory of 1368	1716	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe
PID 1716 wrote to memory of 1368	1716	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe
PID 1716 wrote to memory of 1368	1716	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe
PID 1716 wrote to memory of 1368	1716	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe
PID 1716 wrote to memory of 1368	1716	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe
PID 1716 wrote to memory of 1368	1716	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe
PID 1716 wrote to memory of 1368	1716	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe

C:\Users\Admin\AppData\Local\Temp\aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe
"C:\Users\Admin\AppData\Local\Temp\aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Users\Admin\AppData\Local\Temp\aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe
  start
  2⤵
  PID:1976
- C:\Users\Admin\AppData\Local\Temp\aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe
  watch
  2⤵
  PID:1368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-56-0x0000000000000000-mapping.dmp

Download
memory/1368-59-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1368-64-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1368-66-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1716-54-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1716-55-0x00000000760C1000-0x00000000760C3000-memory.dmp

Filesize
8KB

Download
memory/1716-58-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1976-57-0x0000000000000000-mapping.dmp

Download
memory/1976-60-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1976-63-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1976-65-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download