Analysis
-
max time kernel
29s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 12:50
Static task
static1
Behavioral task
behavioral1
Sample
e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe
Resource
win10v2004-20220901-en
General
-
Target
e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe
-
Size
529KB
-
MD5
a92eaff7bab65e3d09ec920a4c6368e0
-
SHA1
e88069f1d7f46d547d2d2f828d2bd69420c28e9b
-
SHA256
e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459
-
SHA512
b7950bd71ace18ff05f8b9788203ec61ad2279df94408d98e4f2a1a2b1d4931f3b4840ba12365927198c2cdcfb3ee628f5875769cac0d29e4a21675dcf3bf074
-
SSDEEP
12288:vcmH+VW97+rt41llJboQDUm/tFPTe2EdMwTVjRJ49dFgaKfHJbvw2O:yW9yrql6cUKLPTe2iV1S9dcfHBvwr
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exedescription pid process target process PID 2028 wrote to memory of 2008 2028 e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe PID 2028 wrote to memory of 2008 2028 e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe PID 2028 wrote to memory of 2008 2028 e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe PID 2028 wrote to memory of 2008 2028 e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe PID 2028 wrote to memory of 2008 2028 e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe PID 2028 wrote to memory of 2008 2028 e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe PID 2028 wrote to memory of 2008 2028 e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe PID 2028 wrote to memory of 1884 2028 e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe PID 2028 wrote to memory of 1884 2028 e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe PID 2028 wrote to memory of 1884 2028 e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe PID 2028 wrote to memory of 1884 2028 e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe PID 2028 wrote to memory of 1884 2028 e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe PID 2028 wrote to memory of 1884 2028 e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe PID 2028 wrote to memory of 1884 2028 e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe"C:\Users\Admin\AppData\Local\Temp\e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exestart2⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\e61fd6ad39dd99ec63095f90ba99ef393304c0c7db0463531a4b9f47a032e459.exewatch2⤵PID:1884
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1884-55-0x0000000000000000-mapping.dmp
-
memory/1884-60-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1884-63-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/2008-56-0x0000000000000000-mapping.dmp
-
memory/2008-61-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/2008-62-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/2028-54-0x0000000075811000-0x0000000075813000-memory.dmpFilesize
8KB
-
memory/2028-59-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB