0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe
Size

522KB
MD5

10e93d3bce227fb891f4f6f60db637a6
SHA1

fe051807b92dbf956ba61a7ca3dcac2419ec395e
SHA256

0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45
SHA512

3be07f80e3fe32338641e5e87027dfe5d91260b6ef561c970245b8c49f3ed741ec7a2b929f737c82b066ecb637609c309b2e9b7cdb6edf4408622d5da6569e67
SSDEEP

6144:yKxiY/x2b3sz8OFsvKGl+pELQxqVI/dY7ZcCI+CaqpUxdrZPkTY/210YO9ALuEyT:mYp2tSFqqqCWJCDpwtWsjYO9Atwo

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe

description	pid	process	target process
PID 1908 wrote to memory of 276	1908	0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe	0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe
PID 1908 wrote to memory of 276	1908	0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe	0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe
PID 1908 wrote to memory of 276	1908	0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe	0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe
PID 1908 wrote to memory of 276	1908	0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe	0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe
PID 1908 wrote to memory of 276	1908	0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe	0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe
PID 1908 wrote to memory of 276	1908	0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe	0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe
PID 1908 wrote to memory of 276	1908	0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe	0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe
PID 1908 wrote to memory of 1676	1908	0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe	0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe
PID 1908 wrote to memory of 1676	1908	0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe	0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe
PID 1908 wrote to memory of 1676	1908	0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe	0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe
PID 1908 wrote to memory of 1676	1908	0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe	0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe
PID 1908 wrote to memory of 1676	1908	0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe	0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe
PID 1908 wrote to memory of 1676	1908	0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe	0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe
PID 1908 wrote to memory of 1676	1908	0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe	0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe

C:\Users\Admin\AppData\Local\Temp\0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe
"C:\Users\Admin\AppData\Local\Temp\0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1908

C:\Users\Admin\AppData\Local\Temp\0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe
start
2⤵
PID:276

C:\Users\Admin\AppData\Local\Temp\0eb99b530f6a502c693addee41329a496a2cec2bcafeac40b6c8e22dc9997c45.exe
watch
2⤵
PID:1676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/276-57-0x0000000000000000-mapping.dmp

Download
memory/276-61-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/276-63-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/276-64-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1676-56-0x0000000000000000-mapping.dmp

Download
memory/1676-62-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1676-65-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1908-54-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1908-55-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/1908-58-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download