Analysis
-
max time kernel
45s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 11:50
Static task
static1
Behavioral task
behavioral1
Sample
e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe
Resource
win10v2004-20220812-en
General
-
Target
e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe
-
Size
526KB
-
MD5
742c80101a37cb72315b970fcdd4cc46
-
SHA1
0a44f712144e8e8649535d10dee23a9847a9594d
-
SHA256
e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967
-
SHA512
bdee08bb33f58611fbfe0f9c0c650095f6d4d7fbc5d1ace4d5d5f22b327273080ae3f51671ec69ab39e21b6d5fdd13da44c3a15b93c101dc091230315fc22c52
-
SSDEEP
6144:c8G22X9AiQfmqaLFy7pUpACNpZRx4+69RUZwPtmQy1CrxQqD9RSaSz+8O5lio:3y9w92FUqE+hwPvy18xQqpx8O5l7
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exedescription pid process target process PID 2012 wrote to memory of 2004 2012 e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe PID 2012 wrote to memory of 2004 2012 e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe PID 2012 wrote to memory of 2004 2012 e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe PID 2012 wrote to memory of 2004 2012 e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe PID 2012 wrote to memory of 2004 2012 e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe PID 2012 wrote to memory of 2004 2012 e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe PID 2012 wrote to memory of 2004 2012 e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe PID 2012 wrote to memory of 1256 2012 e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe PID 2012 wrote to memory of 1256 2012 e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe PID 2012 wrote to memory of 1256 2012 e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe PID 2012 wrote to memory of 1256 2012 e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe PID 2012 wrote to memory of 1256 2012 e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe PID 2012 wrote to memory of 1256 2012 e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe PID 2012 wrote to memory of 1256 2012 e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe"C:\Users\Admin\AppData\Local\Temp\e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exestart2⤵
-
C:\Users\Admin\AppData\Local\Temp\e9232d29b9831d27d5654f43f152461ed9d4464d1873f6597da7b1e42db73967.exewatch2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1256-56-0x0000000000000000-mapping.dmp
-
memory/1256-60-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1256-64-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1256-66-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2004-57-0x0000000000000000-mapping.dmp
-
memory/2004-59-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2004-63-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2004-65-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2012-54-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2012-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmpFilesize
8KB
-
memory/2012-58-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB