Analysis
-
max time kernel
63s -
max time network
71s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 12:02
Static task
static1
Behavioral task
behavioral1
Sample
9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe
Resource
win10v2004-20220812-en
General
-
Target
9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe
-
Size
526KB
-
MD5
b96192a58c975536a1c1a209a4d00371
-
SHA1
c8398fa3f39917570d8f7b604d3a40fc91388b4e
-
SHA256
9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3
-
SHA512
8ddcd5722fe459ba35685f33431073f6fe88a3fa21b708b31f770b2b3f34e1b3ba90e7a6e2d26df4e7ad6b6589fd3f949a4be15158ffebc9310a8220ba81b8f5
-
SSDEEP
6144:bOserW6ma4pEX+SDbFMjPJEfTIEKCa/OL61z8HwGmQy1CrxQqD9RSaSz+8O5InF:krW6yapf3V61zkwey18xQqpx8O5IF
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exedescription pid process target process PID 1256 wrote to memory of 1636 1256 9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe 9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe PID 1256 wrote to memory of 1636 1256 9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe 9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe PID 1256 wrote to memory of 1636 1256 9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe 9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe PID 1256 wrote to memory of 1636 1256 9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe 9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe PID 1256 wrote to memory of 1636 1256 9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe 9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe PID 1256 wrote to memory of 1636 1256 9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe 9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe PID 1256 wrote to memory of 1636 1256 9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe 9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe PID 1256 wrote to memory of 1472 1256 9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe 9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe PID 1256 wrote to memory of 1472 1256 9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe 9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe PID 1256 wrote to memory of 1472 1256 9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe 9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe PID 1256 wrote to memory of 1472 1256 9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe 9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe PID 1256 wrote to memory of 1472 1256 9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe 9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe PID 1256 wrote to memory of 1472 1256 9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe 9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe PID 1256 wrote to memory of 1472 1256 9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe 9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe"C:\Users\Admin\AppData\Local\Temp\9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exestart2⤵
-
C:\Users\Admin\AppData\Local\Temp\9506e8074cd195c6925072f672434a2212e2624a0677330d2abdb49b3156b7e3.exewatch2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1256-54-0x0000000075D01000-0x0000000075D03000-memory.dmpFilesize
8KB
-
memory/1256-57-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1472-55-0x0000000000000000-mapping.dmp
-
memory/1472-58-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1472-62-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1472-66-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1636-56-0x0000000000000000-mapping.dmp
-
memory/1636-59-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1636-63-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1636-64-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1636-65-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB