Analysis
-
max time kernel
31s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 12:05
Static task
static1
Behavioral task
behavioral1
Sample
85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe
Resource
win10v2004-20220812-en
General
-
Target
85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe
-
Size
522KB
-
MD5
d7f6bcbf3b6fd77a379fd6bacd4db6b1
-
SHA1
524cd317bf9cadc4172da5de381d3dac34c83e62
-
SHA256
85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a
-
SHA512
adf6899a77696a53845504c88ce8c85eebf576d0be3e889fdc5e519dc922acee560764a424c132610f31aece01c354a63f274f01b9ac1e93951ff07f1cfa3b71
-
SSDEEP
6144:TkIAsljmJ/TfSCrHkgFnHCKgfXqDbQCsmQy1CrxQqD9RSaSz+8O5H+34e:WNraBgVHCh6XQCoy18xQqpx8O5H+
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exedescription pid process target process PID 1524 wrote to memory of 1728 1524 85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe 85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe PID 1524 wrote to memory of 1728 1524 85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe 85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe PID 1524 wrote to memory of 1728 1524 85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe 85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe PID 1524 wrote to memory of 1728 1524 85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe 85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe PID 1524 wrote to memory of 1728 1524 85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe 85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe PID 1524 wrote to memory of 1728 1524 85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe 85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe PID 1524 wrote to memory of 1728 1524 85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe 85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe PID 1524 wrote to memory of 1380 1524 85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe 85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe PID 1524 wrote to memory of 1380 1524 85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe 85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe PID 1524 wrote to memory of 1380 1524 85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe 85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe PID 1524 wrote to memory of 1380 1524 85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe 85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe PID 1524 wrote to memory of 1380 1524 85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe 85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe PID 1524 wrote to memory of 1380 1524 85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe 85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe PID 1524 wrote to memory of 1380 1524 85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe 85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe"C:\Users\Admin\AppData\Local\Temp\85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exestart2⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\85fad34fac17c058fc85634a8ed07f3942b6ad9d73676d581d8f8584173f775a.exewatch2⤵PID:1380
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1380-56-0x0000000000000000-mapping.dmp
-
memory/1380-59-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1380-64-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1380-66-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1524-54-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1524-55-0x0000000075CF1000-0x0000000075CF3000-memory.dmpFilesize
8KB
-
memory/1524-58-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1728-57-0x0000000000000000-mapping.dmp
-
memory/1728-60-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1728-63-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1728-65-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB