Analysis

  • max time kernel
    130s
  • max time network
    209s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 12:58

General

  • Target

    d88c950baae6b0178e6467db373700383f1b53debd60888f9805707079cae747.exe

  • Size

    521KB

  • MD5

    b727f0b3e72bbccaf6e31daad019d05d

  • SHA1

    5cff78c19bcafc72fdc2e603b417dfffb0c44a7d

  • SHA256

    d88c950baae6b0178e6467db373700383f1b53debd60888f9805707079cae747

  • SHA512

    5bc4b264354f7d46fbeeabe45413e482d7d29e6c214f4c852c515d3bd6158a8c126dde6edb2f6d038acc51ca6a3d23762b723d7202936ca2cb1311c1437e7918

  • SSDEEP

    6144:bDsJX4aqFfDViDSp2O0jQm+J2I+LN9TWjyEFji8eAMyDv3Sg8Gf8yRtD3iBeJQGt:bDsUF7D0Um+w8FyjGexGWRLUD

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d88c950baae6b0178e6467db373700383f1b53debd60888f9805707079cae747.exe
    "C:\Users\Admin\AppData\Local\Temp\d88c950baae6b0178e6467db373700383f1b53debd60888f9805707079cae747.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1256
    • C:\Users\Admin\AppData\Local\Temp\d88c950baae6b0178e6467db373700383f1b53debd60888f9805707079cae747.exe
      start
      2⤵
        PID:1912
      • C:\Users\Admin\AppData\Local\Temp\d88c950baae6b0178e6467db373700383f1b53debd60888f9805707079cae747.exe
        watch
        2⤵
          PID:1636

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1256-54-0x0000000075D11000-0x0000000075D13000-memory.dmp

        Filesize

        8KB

      • memory/1256-58-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

      • memory/1636-55-0x0000000000000000-mapping.dmp

      • memory/1636-61-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

      • memory/1636-63-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

      • memory/1636-65-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

      • memory/1912-56-0x0000000000000000-mapping.dmp

      • memory/1912-60-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

      • memory/1912-62-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

      • memory/1912-64-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB