9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc

Analysis

max time kernel
48s
max time network
96s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 12:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe
Size

522KB
MD5

5a12e0f5f3230a4385b83e35da08ff40
SHA1

9d55ff9864381704812b20eea711c7c748143d3b
SHA256

9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc
SHA512

355c6e3c9a1251d01dbdc3c18e524d11c4fb9429307ff66fd46a3d735f9772ccaa5065c3c0b2c3fd046bb1c18679cfa86102eef774d3792f76f071dc589e809a
SSDEEP

12288:PbVepIab8IQ5LBGI4fmgy18xQqpx8O5TF:heCG8IQ5VGnatqpx8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe

description	pid	process	target process
PID 1956 wrote to memory of 1712	1956	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe
PID 1956 wrote to memory of 1712	1956	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe
PID 1956 wrote to memory of 1712	1956	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe
PID 1956 wrote to memory of 1712	1956	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe
PID 1956 wrote to memory of 1712	1956	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe
PID 1956 wrote to memory of 1712	1956	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe
PID 1956 wrote to memory of 1712	1956	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe
PID 1956 wrote to memory of 1472	1956	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe
PID 1956 wrote to memory of 1472	1956	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe
PID 1956 wrote to memory of 1472	1956	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe
PID 1956 wrote to memory of 1472	1956	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe
PID 1956 wrote to memory of 1472	1956	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe
PID 1956 wrote to memory of 1472	1956	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe
PID 1956 wrote to memory of 1472	1956	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe

C:\Users\Admin\AppData\Local\Temp\9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe
"C:\Users\Admin\AppData\Local\Temp\9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Users\Admin\AppData\Local\Temp\9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe
  start
  2⤵
  PID:1712
- C:\Users\Admin\AppData\Local\Temp\9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe
  watch
  2⤵
  PID:1472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1472-56-0x0000000000000000-mapping.dmp

Download
memory/1472-60-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1472-64-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1472-66-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1712-57-0x0000000000000000-mapping.dmp

Download
memory/1712-59-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1712-63-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1712-65-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1956-54-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1956-55-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/1956-58-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download