Analysis
-
max time kernel
41s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 12:48
Static task
static1
Behavioral task
behavioral1
Sample
ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe
Resource
win10v2004-20221111-en
General
-
Target
ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe
-
Size
518KB
-
MD5
44be30029ca09c9d647d593d2213c648
-
SHA1
912ea1af9f98ed5cf2db5fc185bd49a36a8aec95
-
SHA256
ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085
-
SHA512
23c3041f6e1ffef732e841ce58567fba648e6d827b2ab243ca5a82e1abbe451fdbd3c67fd7e472b9d230935ba9392b2d07cf1fb88d4a35d8714955f49d3ae1c8
-
SSDEEP
12288:UrlA7YzuVuM18Qa/kXvwPUjASES/ya+WJPwTOEV/f:U+k6VuY8Qc24PuAsz+OPwTvV/
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exedescription pid process target process PID 1628 wrote to memory of 1520 1628 ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe PID 1628 wrote to memory of 1520 1628 ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe PID 1628 wrote to memory of 1520 1628 ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe PID 1628 wrote to memory of 1520 1628 ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe PID 1628 wrote to memory of 1520 1628 ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe PID 1628 wrote to memory of 1520 1628 ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe PID 1628 wrote to memory of 1520 1628 ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe PID 1628 wrote to memory of 1380 1628 ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe PID 1628 wrote to memory of 1380 1628 ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe PID 1628 wrote to memory of 1380 1628 ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe PID 1628 wrote to memory of 1380 1628 ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe PID 1628 wrote to memory of 1380 1628 ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe PID 1628 wrote to memory of 1380 1628 ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe PID 1628 wrote to memory of 1380 1628 ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe"C:\Users\Admin\AppData\Local\Temp\ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exestart2⤵
-
C:\Users\Admin\AppData\Local\Temp\ea0ffd966001027232eacbcf28a704c9dddec582e426c0a4d67cc20c22d3d085.exewatch2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1380-55-0x0000000000000000-mapping.dmp
-
memory/1380-61-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1380-63-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1520-56-0x0000000000000000-mapping.dmp
-
memory/1520-60-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1520-62-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1628-54-0x0000000075ED1000-0x0000000075ED3000-memory.dmpFilesize
8KB
-
memory/1628-58-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB