Analysis
-
max time kernel
146s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 11:11
Static task
static1
Behavioral task
behavioral1
Sample
2fe6f16687ebd8eca02b12a031927dac306e52235ac2f2e697dcef0477f16756.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2fe6f16687ebd8eca02b12a031927dac306e52235ac2f2e697dcef0477f16756.exe
Resource
win10v2004-20220812-en
General
-
Target
2fe6f16687ebd8eca02b12a031927dac306e52235ac2f2e697dcef0477f16756.exe
-
Size
521KB
-
MD5
8002bd79417184256c538043526787e0
-
SHA1
03b472b267e9e2011af7ccf09f2c154a0e157795
-
SHA256
2fe6f16687ebd8eca02b12a031927dac306e52235ac2f2e697dcef0477f16756
-
SHA512
e6be66da65bc7702594c942e15406a438d6ea66e77c8e8d27eae4c56d0131dda462ec10a7f6ffa60189e1c1696d1696186e69e9d762227df6bc066cde319f06a
-
SSDEEP
12288:lfMa4CCmY6+rpP0gHOL/jxo5FGexGWRLUt:lfP44Emtoz9GWS
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
2fe6f16687ebd8eca02b12a031927dac306e52235ac2f2e697dcef0477f16756.exedescription pid process target process PID 456 wrote to memory of 2112 456 2fe6f16687ebd8eca02b12a031927dac306e52235ac2f2e697dcef0477f16756.exe 2fe6f16687ebd8eca02b12a031927dac306e52235ac2f2e697dcef0477f16756.exe PID 456 wrote to memory of 2112 456 2fe6f16687ebd8eca02b12a031927dac306e52235ac2f2e697dcef0477f16756.exe 2fe6f16687ebd8eca02b12a031927dac306e52235ac2f2e697dcef0477f16756.exe PID 456 wrote to memory of 2112 456 2fe6f16687ebd8eca02b12a031927dac306e52235ac2f2e697dcef0477f16756.exe 2fe6f16687ebd8eca02b12a031927dac306e52235ac2f2e697dcef0477f16756.exe PID 456 wrote to memory of 768 456 2fe6f16687ebd8eca02b12a031927dac306e52235ac2f2e697dcef0477f16756.exe 2fe6f16687ebd8eca02b12a031927dac306e52235ac2f2e697dcef0477f16756.exe PID 456 wrote to memory of 768 456 2fe6f16687ebd8eca02b12a031927dac306e52235ac2f2e697dcef0477f16756.exe 2fe6f16687ebd8eca02b12a031927dac306e52235ac2f2e697dcef0477f16756.exe PID 456 wrote to memory of 768 456 2fe6f16687ebd8eca02b12a031927dac306e52235ac2f2e697dcef0477f16756.exe 2fe6f16687ebd8eca02b12a031927dac306e52235ac2f2e697dcef0477f16756.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fe6f16687ebd8eca02b12a031927dac306e52235ac2f2e697dcef0477f16756.exe"C:\Users\Admin\AppData\Local\Temp\2fe6f16687ebd8eca02b12a031927dac306e52235ac2f2e697dcef0477f16756.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2fe6f16687ebd8eca02b12a031927dac306e52235ac2f2e697dcef0477f16756.exestart2⤵
-
C:\Users\Admin\AppData\Local\Temp\2fe6f16687ebd8eca02b12a031927dac306e52235ac2f2e697dcef0477f16756.exewatch2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/456-132-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/456-135-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/768-133-0x0000000000000000-mapping.dmp
-
memory/768-137-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/768-139-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/2112-134-0x0000000000000000-mapping.dmp
-
memory/2112-136-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/2112-138-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB