7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b

Analysis

max time kernel
45s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 12:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe
Size

522KB
MD5

b05512b7b5589e147046a48637174d85
SHA1

c0038fd18cc12fe05c73908662992b53c2b7d2c3
SHA256

7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b
SHA512

e8c852bebf5bc4bfb7cdcfbd85357689f479ef10b42b01b09754e0f5be25294dab35a1f4a896a82ed4ae956a7e42588d34ecdada755f37b6b05f15e9c29cc80d
SSDEEP

12288:soklxRzHPLUFL2cPavjHy18xQqpx8O5c:F+PzHPL+FSvjHatqpx8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe

description	pid	process	target process
PID 1308 wrote to memory of 1148	1308	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe
PID 1308 wrote to memory of 1148	1308	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe
PID 1308 wrote to memory of 1148	1308	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe
PID 1308 wrote to memory of 1148	1308	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe
PID 1308 wrote to memory of 1148	1308	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe
PID 1308 wrote to memory of 1148	1308	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe
PID 1308 wrote to memory of 1148	1308	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe
PID 1308 wrote to memory of 840	1308	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe
PID 1308 wrote to memory of 840	1308	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe
PID 1308 wrote to memory of 840	1308	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe
PID 1308 wrote to memory of 840	1308	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe
PID 1308 wrote to memory of 840	1308	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe
PID 1308 wrote to memory of 840	1308	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe
PID 1308 wrote to memory of 840	1308	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe

C:\Users\Admin\AppData\Local\Temp\7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe
"C:\Users\Admin\AppData\Local\Temp\7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1308

C:\Users\Admin\AppData\Local\Temp\7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe
start
2⤵
PID:1148

C:\Users\Admin\AppData\Local\Temp\7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe
watch
2⤵
PID:840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/840-55-0x0000000000000000-mapping.dmp

Download
memory/840-59-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/840-63-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/840-65-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1148-56-0x0000000000000000-mapping.dmp

Download
memory/1148-58-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1148-62-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1148-64-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1308-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/1308-57-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download