Analysis
-
max time kernel
35s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 12:59
Static task
static1
Behavioral task
behavioral1
Sample
d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe
Resource
win10v2004-20221111-en
General
-
Target
d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe
-
Size
521KB
-
MD5
cde0b5fd28a95d010901a1191b35f7d8
-
SHA1
8d1d9432b64635383e1af2340ca18e2c2ae5aa87
-
SHA256
d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36
-
SHA512
46c80c52831e21379d282eac6fb645486897bbbdaac7c473249a1e1763b0e0f9fc6a091f5ced52b94db97da83929d7c32ac32a47e7665396ce309da0f9e5ee4a
-
SSDEEP
6144:cRMRjpHhJQWDxLC/9lLPUBaFhLNK71DFIPPqhKxdxsZZSkv3Sg8Gf8yRtD3iBeJr:ceZvispYPPTpGexGWRLUL8
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exedescription pid process target process PID 1476 wrote to memory of 600 1476 d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe PID 1476 wrote to memory of 600 1476 d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe PID 1476 wrote to memory of 600 1476 d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe PID 1476 wrote to memory of 600 1476 d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe PID 1476 wrote to memory of 600 1476 d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe PID 1476 wrote to memory of 600 1476 d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe PID 1476 wrote to memory of 600 1476 d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe PID 1476 wrote to memory of 1080 1476 d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe PID 1476 wrote to memory of 1080 1476 d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe PID 1476 wrote to memory of 1080 1476 d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe PID 1476 wrote to memory of 1080 1476 d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe PID 1476 wrote to memory of 1080 1476 d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe PID 1476 wrote to memory of 1080 1476 d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe PID 1476 wrote to memory of 1080 1476 d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe"C:\Users\Admin\AppData\Local\Temp\d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exestart2⤵
-
C:\Users\Admin\AppData\Local\Temp\d67b5af506c08aab3a8aed56de5bf77b5f30728baafd08554b6ab36cf612fc36.exewatch2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/600-57-0x0000000000000000-mapping.dmp
-
memory/600-62-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/600-63-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1080-56-0x0000000000000000-mapping.dmp
-
memory/1080-61-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1080-64-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1476-54-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1476-55-0x0000000074C11000-0x0000000074C13000-memory.dmpFilesize
8KB
-
memory/1476-58-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB