Analysis
-
max time kernel
147s -
max time network
195s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 12:47
Static task
static1
Behavioral task
behavioral1
Sample
ec60d51e00a77d716ccfd192b0139a38a64427aa0298d2d0e49cd3a59ceaeb11.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ec60d51e00a77d716ccfd192b0139a38a64427aa0298d2d0e49cd3a59ceaeb11.exe
Resource
win10v2004-20221111-en
General
-
Target
ec60d51e00a77d716ccfd192b0139a38a64427aa0298d2d0e49cd3a59ceaeb11.exe
-
Size
522KB
-
MD5
748f941bf4c710d763f73799c15ded2f
-
SHA1
092637cbf04c04d64dc6d2eb203e48422b5e2cdd
-
SHA256
ec60d51e00a77d716ccfd192b0139a38a64427aa0298d2d0e49cd3a59ceaeb11
-
SHA512
510ddd63298f8f25641a3d5d27f2978022bdb75a873d740213893cd0c14e47c1a66c2a7066e03c9f7540ed6bd0418f608ff356c2a9aab52d2c7457ac8ec16543
-
SSDEEP
6144:eTCEP18PEE1BxdAHKgE5NxT2nnhqLCDfHladZjL3jvmQy1CrxQqD9RSaSz+8O5Xj:H0upFN4nncee33jVy18xQqpx8O5X
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
ec60d51e00a77d716ccfd192b0139a38a64427aa0298d2d0e49cd3a59ceaeb11.exedescription pid process target process PID 3864 wrote to memory of 632 3864 ec60d51e00a77d716ccfd192b0139a38a64427aa0298d2d0e49cd3a59ceaeb11.exe ec60d51e00a77d716ccfd192b0139a38a64427aa0298d2d0e49cd3a59ceaeb11.exe PID 3864 wrote to memory of 632 3864 ec60d51e00a77d716ccfd192b0139a38a64427aa0298d2d0e49cd3a59ceaeb11.exe ec60d51e00a77d716ccfd192b0139a38a64427aa0298d2d0e49cd3a59ceaeb11.exe PID 3864 wrote to memory of 632 3864 ec60d51e00a77d716ccfd192b0139a38a64427aa0298d2d0e49cd3a59ceaeb11.exe ec60d51e00a77d716ccfd192b0139a38a64427aa0298d2d0e49cd3a59ceaeb11.exe PID 3864 wrote to memory of 4288 3864 ec60d51e00a77d716ccfd192b0139a38a64427aa0298d2d0e49cd3a59ceaeb11.exe ec60d51e00a77d716ccfd192b0139a38a64427aa0298d2d0e49cd3a59ceaeb11.exe PID 3864 wrote to memory of 4288 3864 ec60d51e00a77d716ccfd192b0139a38a64427aa0298d2d0e49cd3a59ceaeb11.exe ec60d51e00a77d716ccfd192b0139a38a64427aa0298d2d0e49cd3a59ceaeb11.exe PID 3864 wrote to memory of 4288 3864 ec60d51e00a77d716ccfd192b0139a38a64427aa0298d2d0e49cd3a59ceaeb11.exe ec60d51e00a77d716ccfd192b0139a38a64427aa0298d2d0e49cd3a59ceaeb11.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec60d51e00a77d716ccfd192b0139a38a64427aa0298d2d0e49cd3a59ceaeb11.exe"C:\Users\Admin\AppData\Local\Temp\ec60d51e00a77d716ccfd192b0139a38a64427aa0298d2d0e49cd3a59ceaeb11.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\ec60d51e00a77d716ccfd192b0139a38a64427aa0298d2d0e49cd3a59ceaeb11.exestart2⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\ec60d51e00a77d716ccfd192b0139a38a64427aa0298d2d0e49cd3a59ceaeb11.exewatch2⤵PID:4288
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/632-137-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/632-143-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/632-134-0x0000000000000000-mapping.dmp
-
memory/632-142-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/632-140-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/3864-135-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/3864-132-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4288-138-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4288-139-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4288-136-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4288-133-0x0000000000000000-mapping.dmp
-
memory/4288-141-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4288-144-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB