Analysis
-
max time kernel
251s -
max time network
319s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 12:06
Static task
static1
Behavioral task
behavioral1
Sample
805fe7d11c74cb52eb42b790ebbb34a02c20e512d5d2307cc8585960c98ac935.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
805fe7d11c74cb52eb42b790ebbb34a02c20e512d5d2307cc8585960c98ac935.exe
Resource
win10v2004-20221111-en
General
-
Target
805fe7d11c74cb52eb42b790ebbb34a02c20e512d5d2307cc8585960c98ac935.exe
-
Size
526KB
-
MD5
e927db0375eaee26eea7389de6d0b491
-
SHA1
8683b40a5c90f5f6aea0dcf3f1b10ebf86210b7d
-
SHA256
805fe7d11c74cb52eb42b790ebbb34a02c20e512d5d2307cc8585960c98ac935
-
SHA512
80caba4bfe52a5d4ed3a9ef60e4ac3d5e90cddb00425a1522ae64675e25b3b664dca2620d693558fd7c6653217a2b8dcf61cbaf55d123591a7bc2b6f9803ceb1
-
SSDEEP
6144:HX/aO53mtkKx4LZuzQUEgPJqBgpGFPZVBohR9bSf0wmQy1CrxQqD9RSaSz+8O5bR:PaOQj4LEogqBVw3Wy18xQqpx8O5bR
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
805fe7d11c74cb52eb42b790ebbb34a02c20e512d5d2307cc8585960c98ac935.exedescription pid process target process PID 1672 wrote to memory of 1524 1672 805fe7d11c74cb52eb42b790ebbb34a02c20e512d5d2307cc8585960c98ac935.exe 805fe7d11c74cb52eb42b790ebbb34a02c20e512d5d2307cc8585960c98ac935.exe PID 1672 wrote to memory of 1524 1672 805fe7d11c74cb52eb42b790ebbb34a02c20e512d5d2307cc8585960c98ac935.exe 805fe7d11c74cb52eb42b790ebbb34a02c20e512d5d2307cc8585960c98ac935.exe PID 1672 wrote to memory of 1524 1672 805fe7d11c74cb52eb42b790ebbb34a02c20e512d5d2307cc8585960c98ac935.exe 805fe7d11c74cb52eb42b790ebbb34a02c20e512d5d2307cc8585960c98ac935.exe PID 1672 wrote to memory of 3640 1672 805fe7d11c74cb52eb42b790ebbb34a02c20e512d5d2307cc8585960c98ac935.exe 805fe7d11c74cb52eb42b790ebbb34a02c20e512d5d2307cc8585960c98ac935.exe PID 1672 wrote to memory of 3640 1672 805fe7d11c74cb52eb42b790ebbb34a02c20e512d5d2307cc8585960c98ac935.exe 805fe7d11c74cb52eb42b790ebbb34a02c20e512d5d2307cc8585960c98ac935.exe PID 1672 wrote to memory of 3640 1672 805fe7d11c74cb52eb42b790ebbb34a02c20e512d5d2307cc8585960c98ac935.exe 805fe7d11c74cb52eb42b790ebbb34a02c20e512d5d2307cc8585960c98ac935.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\805fe7d11c74cb52eb42b790ebbb34a02c20e512d5d2307cc8585960c98ac935.exe"C:\Users\Admin\AppData\Local\Temp\805fe7d11c74cb52eb42b790ebbb34a02c20e512d5d2307cc8585960c98ac935.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\805fe7d11c74cb52eb42b790ebbb34a02c20e512d5d2307cc8585960c98ac935.exestart2⤵
-
C:\Users\Admin\AppData\Local\Temp\805fe7d11c74cb52eb42b790ebbb34a02c20e512d5d2307cc8585960c98ac935.exewatch2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1524-135-0x0000000000000000-mapping.dmp
-
memory/1524-138-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1524-140-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1672-132-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1672-133-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1672-136-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/3640-134-0x0000000000000000-mapping.dmp
-
memory/3640-137-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/3640-139-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB