Analysis
-
max time kernel
17s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 12:47
Static task
static1
Behavioral task
behavioral1
Sample
eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe
Resource
win10v2004-20220812-en
General
-
Target
eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe
-
Size
522KB
-
MD5
a5230176eebd97da98cae6bd71af01d5
-
SHA1
d439535df9ea6f9a6cc86a3ef5a2d5c40d6bcf74
-
SHA256
eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565
-
SHA512
d97f91a99e77f9f2b14ae8bbe605d77e95bef9783921c212e12aab49e95d19b0ee554d6d751cffc7980f9cd9151a91517d43af308f58f98a66d6ceca437b192c
-
SSDEEP
6144:MbiEGZXNDBXjU8e5PbTax0eTMpJ4Es7s+t55A/Pw/tGmQy1CrxQqD9RSaSz+8O51:HEGZNBXc20cE4mAIy18xQqpx8O5mS
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exedescription pid process target process PID 276 wrote to memory of 1048 276 eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe PID 276 wrote to memory of 1048 276 eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe PID 276 wrote to memory of 1048 276 eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe PID 276 wrote to memory of 1048 276 eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe PID 276 wrote to memory of 1048 276 eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe PID 276 wrote to memory of 1048 276 eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe PID 276 wrote to memory of 1048 276 eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe PID 276 wrote to memory of 1916 276 eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe PID 276 wrote to memory of 1916 276 eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe PID 276 wrote to memory of 1916 276 eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe PID 276 wrote to memory of 1916 276 eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe PID 276 wrote to memory of 1916 276 eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe PID 276 wrote to memory of 1916 276 eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe PID 276 wrote to memory of 1916 276 eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe"C:\Users\Admin\AppData\Local\Temp\eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exestart2⤵
-
C:\Users\Admin\AppData\Local\Temp\eb5756fe4cc483cd0b88bdcbf3b9413f661238da87d0b2338ef384a347b1f565.exewatch2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/276-54-0x00000000753C1000-0x00000000753C3000-memory.dmpFilesize
8KB
-
memory/276-57-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1048-56-0x0000000000000000-mapping.dmp
-
memory/1048-58-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1048-62-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1048-64-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1916-55-0x0000000000000000-mapping.dmp
-
memory/1916-59-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1916-63-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1916-65-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB