Analysis
-
max time kernel
160s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 12:03
Static task
static1
Behavioral task
behavioral1
Sample
8de87db07ef8259574531fb556f21acdbcc6c404fd3f46995a7a947b276c03b0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8de87db07ef8259574531fb556f21acdbcc6c404fd3f46995a7a947b276c03b0.exe
Resource
win10v2004-20220812-en
General
-
Target
8de87db07ef8259574531fb556f21acdbcc6c404fd3f46995a7a947b276c03b0.exe
-
Size
518KB
-
MD5
cc7e982a374d0938e0037e91d3a830c1
-
SHA1
b867d33f7737d747b2e437837a0c1e4e46642f10
-
SHA256
8de87db07ef8259574531fb556f21acdbcc6c404fd3f46995a7a947b276c03b0
-
SHA512
4ea7a6553fd22ebdcd096d624d48476b86f04199db30f2829420e7867cd98aaa03c2ab7da0d02d83b956aae7557b33aa3125608ce3be696ed0c1bffa2e9db4d1
-
SSDEEP
12288:ooverM083NPV4pY71wYYlLPt5oKnWq3Cob:oPM0sopFlLPt5/WvQ
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
8de87db07ef8259574531fb556f21acdbcc6c404fd3f46995a7a947b276c03b0.exedescription pid process target process PID 568 wrote to memory of 1424 568 8de87db07ef8259574531fb556f21acdbcc6c404fd3f46995a7a947b276c03b0.exe 8de87db07ef8259574531fb556f21acdbcc6c404fd3f46995a7a947b276c03b0.exe PID 568 wrote to memory of 1424 568 8de87db07ef8259574531fb556f21acdbcc6c404fd3f46995a7a947b276c03b0.exe 8de87db07ef8259574531fb556f21acdbcc6c404fd3f46995a7a947b276c03b0.exe PID 568 wrote to memory of 1424 568 8de87db07ef8259574531fb556f21acdbcc6c404fd3f46995a7a947b276c03b0.exe 8de87db07ef8259574531fb556f21acdbcc6c404fd3f46995a7a947b276c03b0.exe PID 568 wrote to memory of 4596 568 8de87db07ef8259574531fb556f21acdbcc6c404fd3f46995a7a947b276c03b0.exe 8de87db07ef8259574531fb556f21acdbcc6c404fd3f46995a7a947b276c03b0.exe PID 568 wrote to memory of 4596 568 8de87db07ef8259574531fb556f21acdbcc6c404fd3f46995a7a947b276c03b0.exe 8de87db07ef8259574531fb556f21acdbcc6c404fd3f46995a7a947b276c03b0.exe PID 568 wrote to memory of 4596 568 8de87db07ef8259574531fb556f21acdbcc6c404fd3f46995a7a947b276c03b0.exe 8de87db07ef8259574531fb556f21acdbcc6c404fd3f46995a7a947b276c03b0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8de87db07ef8259574531fb556f21acdbcc6c404fd3f46995a7a947b276c03b0.exe"C:\Users\Admin\AppData\Local\Temp\8de87db07ef8259574531fb556f21acdbcc6c404fd3f46995a7a947b276c03b0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\8de87db07ef8259574531fb556f21acdbcc6c404fd3f46995a7a947b276c03b0.exestart2⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\8de87db07ef8259574531fb556f21acdbcc6c404fd3f46995a7a947b276c03b0.exewatch2⤵PID:4596
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/568-134-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1424-133-0x0000000000000000-mapping.dmp
-
memory/1424-136-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1424-137-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1424-139-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/4596-132-0x0000000000000000-mapping.dmp
-
memory/4596-135-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/4596-138-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/4596-140-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB