Analysis
-
max time kernel
170s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 12:52
Static task
static1
Behavioral task
behavioral1
Sample
e329ddbad242dbda6240ba92258f001248810d5e62b7a95613727639a9f63c22.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e329ddbad242dbda6240ba92258f001248810d5e62b7a95613727639a9f63c22.exe
Resource
win10v2004-20221111-en
General
-
Target
e329ddbad242dbda6240ba92258f001248810d5e62b7a95613727639a9f63c22.exe
-
Size
528KB
-
MD5
f3c129c87a745a9678149414347985d5
-
SHA1
0cf8e894b84796acc015b7efb2d2706a4b3e0776
-
SHA256
e329ddbad242dbda6240ba92258f001248810d5e62b7a95613727639a9f63c22
-
SHA512
e69c3b95b640985b3950332cbfdc6546f1d296b976e006cf7a1c16bcb385f5873f8cc3225d05869a456405f59c4c3024e248d4f1e61eb0f22d5aa32edeaddcec
-
SSDEEP
12288:nCKlX6m7Ggkp2iE10wh2DhqpnAToZlQm:n6gkp2iU0wS8lQm
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
e329ddbad242dbda6240ba92258f001248810d5e62b7a95613727639a9f63c22.exedescription pid process target process PID 2392 wrote to memory of 4468 2392 e329ddbad242dbda6240ba92258f001248810d5e62b7a95613727639a9f63c22.exe e329ddbad242dbda6240ba92258f001248810d5e62b7a95613727639a9f63c22.exe PID 2392 wrote to memory of 4468 2392 e329ddbad242dbda6240ba92258f001248810d5e62b7a95613727639a9f63c22.exe e329ddbad242dbda6240ba92258f001248810d5e62b7a95613727639a9f63c22.exe PID 2392 wrote to memory of 4468 2392 e329ddbad242dbda6240ba92258f001248810d5e62b7a95613727639a9f63c22.exe e329ddbad242dbda6240ba92258f001248810d5e62b7a95613727639a9f63c22.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e329ddbad242dbda6240ba92258f001248810d5e62b7a95613727639a9f63c22.exe"C:\Users\Admin\AppData\Local\Temp\e329ddbad242dbda6240ba92258f001248810d5e62b7a95613727639a9f63c22.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e329ddbad242dbda6240ba92258f001248810d5e62b7a95613727639a9f63c22.exetear2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2392-132-0x0000000000400000-0x0000000000490000-memory.dmpFilesize
576KB
-
memory/2392-134-0x0000000000400000-0x0000000000490000-memory.dmpFilesize
576KB
-
memory/4468-133-0x0000000000000000-mapping.dmp
-
memory/4468-135-0x0000000000400000-0x0000000000490000-memory.dmpFilesize
576KB
-
memory/4468-136-0x0000000000400000-0x0000000000490000-memory.dmpFilesize
576KB