Analysis
-
max time kernel
41s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 12:59
Static task
static1
Behavioral task
behavioral1
Sample
d6d21167c68cb374c7e8618f2f12eabcaf4c2bc53f1572067f3a7e302c7711aa.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d6d21167c68cb374c7e8618f2f12eabcaf4c2bc53f1572067f3a7e302c7711aa.exe
Resource
win10v2004-20220812-en
General
-
Target
d6d21167c68cb374c7e8618f2f12eabcaf4c2bc53f1572067f3a7e302c7711aa.exe
-
Size
533KB
-
MD5
91e5bf27ace3ccbb5bdeff61cc1fac70
-
SHA1
eec42694e9853bbb8991c85e5fd79a39cc239527
-
SHA256
d6d21167c68cb374c7e8618f2f12eabcaf4c2bc53f1572067f3a7e302c7711aa
-
SHA512
0caccd322011074de2351eac615104ba8bac842205cb1b855f4fbf300d46c9ab8d959fbf95734dd4df62aa7e674a475528a2f57de95e76b2037726581520c8cb
-
SSDEEP
12288:He/dPYELtGhRcNH4dB4kPvFcHrRoWL0+fJgv08:HevGRhnvml3Jg88
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
d6d21167c68cb374c7e8618f2f12eabcaf4c2bc53f1572067f3a7e302c7711aa.exedescription pid process target process PID 1280 wrote to memory of 608 1280 d6d21167c68cb374c7e8618f2f12eabcaf4c2bc53f1572067f3a7e302c7711aa.exe d6d21167c68cb374c7e8618f2f12eabcaf4c2bc53f1572067f3a7e302c7711aa.exe PID 1280 wrote to memory of 608 1280 d6d21167c68cb374c7e8618f2f12eabcaf4c2bc53f1572067f3a7e302c7711aa.exe d6d21167c68cb374c7e8618f2f12eabcaf4c2bc53f1572067f3a7e302c7711aa.exe PID 1280 wrote to memory of 608 1280 d6d21167c68cb374c7e8618f2f12eabcaf4c2bc53f1572067f3a7e302c7711aa.exe d6d21167c68cb374c7e8618f2f12eabcaf4c2bc53f1572067f3a7e302c7711aa.exe PID 1280 wrote to memory of 608 1280 d6d21167c68cb374c7e8618f2f12eabcaf4c2bc53f1572067f3a7e302c7711aa.exe d6d21167c68cb374c7e8618f2f12eabcaf4c2bc53f1572067f3a7e302c7711aa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6d21167c68cb374c7e8618f2f12eabcaf4c2bc53f1572067f3a7e302c7711aa.exe"C:\Users\Admin\AppData\Local\Temp\d6d21167c68cb374c7e8618f2f12eabcaf4c2bc53f1572067f3a7e302c7711aa.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d6d21167c68cb374c7e8618f2f12eabcaf4c2bc53f1572067f3a7e302c7711aa.exetear2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/608-55-0x0000000000000000-mapping.dmp
-
memory/608-58-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/608-59-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/1280-54-0x0000000075811000-0x0000000075813000-memory.dmpFilesize
8KB
-
memory/1280-56-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB