Analysis
-
max time kernel
151s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 12:56
Static task
static1
Behavioral task
behavioral1
Sample
dc0c2b3a31f8e13135e4fb49a4fd025394af757e25d76fd19d1d33c46ca80a18.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
dc0c2b3a31f8e13135e4fb49a4fd025394af757e25d76fd19d1d33c46ca80a18.exe
Resource
win10v2004-20221111-en
General
-
Target
dc0c2b3a31f8e13135e4fb49a4fd025394af757e25d76fd19d1d33c46ca80a18.exe
-
Size
524KB
-
MD5
b77063c031b5100ecfbe1ccc567304bf
-
SHA1
6ad074b8fa8d4da8999cf6e5ea1590d1fc0ef48d
-
SHA256
dc0c2b3a31f8e13135e4fb49a4fd025394af757e25d76fd19d1d33c46ca80a18
-
SHA512
637170af0b5675fcb681d6f27c0116c116e8ca3c430a47d5ce51096712137cf0cc9e4608fad78a0414c2251723f668467fb13c7a401f54b335b776dc1b05adb8
-
SSDEEP
12288:m7c+uFYbS36o3z7NWv4bON/uL63PTb/g0OJp/7bW:7+W36o3zMOy/uE/Qfja
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
dc0c2b3a31f8e13135e4fb49a4fd025394af757e25d76fd19d1d33c46ca80a18.exedescription pid process target process PID 4844 wrote to memory of 4268 4844 dc0c2b3a31f8e13135e4fb49a4fd025394af757e25d76fd19d1d33c46ca80a18.exe dc0c2b3a31f8e13135e4fb49a4fd025394af757e25d76fd19d1d33c46ca80a18.exe PID 4844 wrote to memory of 4268 4844 dc0c2b3a31f8e13135e4fb49a4fd025394af757e25d76fd19d1d33c46ca80a18.exe dc0c2b3a31f8e13135e4fb49a4fd025394af757e25d76fd19d1d33c46ca80a18.exe PID 4844 wrote to memory of 4268 4844 dc0c2b3a31f8e13135e4fb49a4fd025394af757e25d76fd19d1d33c46ca80a18.exe dc0c2b3a31f8e13135e4fb49a4fd025394af757e25d76fd19d1d33c46ca80a18.exe PID 4844 wrote to memory of 4296 4844 dc0c2b3a31f8e13135e4fb49a4fd025394af757e25d76fd19d1d33c46ca80a18.exe dc0c2b3a31f8e13135e4fb49a4fd025394af757e25d76fd19d1d33c46ca80a18.exe PID 4844 wrote to memory of 4296 4844 dc0c2b3a31f8e13135e4fb49a4fd025394af757e25d76fd19d1d33c46ca80a18.exe dc0c2b3a31f8e13135e4fb49a4fd025394af757e25d76fd19d1d33c46ca80a18.exe PID 4844 wrote to memory of 4296 4844 dc0c2b3a31f8e13135e4fb49a4fd025394af757e25d76fd19d1d33c46ca80a18.exe dc0c2b3a31f8e13135e4fb49a4fd025394af757e25d76fd19d1d33c46ca80a18.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc0c2b3a31f8e13135e4fb49a4fd025394af757e25d76fd19d1d33c46ca80a18.exe"C:\Users\Admin\AppData\Local\Temp\dc0c2b3a31f8e13135e4fb49a4fd025394af757e25d76fd19d1d33c46ca80a18.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dc0c2b3a31f8e13135e4fb49a4fd025394af757e25d76fd19d1d33c46ca80a18.exestart2⤵
-
C:\Users\Admin\AppData\Local\Temp\dc0c2b3a31f8e13135e4fb49a4fd025394af757e25d76fd19d1d33c46ca80a18.exewatch2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4268-133-0x0000000000000000-mapping.dmp
-
memory/4268-135-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4268-137-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4268-139-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4296-132-0x0000000000000000-mapping.dmp
-
memory/4296-136-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4296-138-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4296-140-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4844-134-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB