Analysis
-
max time kernel
39s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 13:01
Static task
static1
Behavioral task
behavioral1
Sample
d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe
Resource
win10v2004-20220901-en
General
-
Target
d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe
-
Size
522KB
-
MD5
8fed28010193384897012f71d07bc041
-
SHA1
502d3d6b33da08683810c6773e3dffe86b763e2d
-
SHA256
d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7
-
SHA512
6f511903c2bd90956c7750acd27026b0a754260055eed981a3b1c8807cb36edaea1b7220f312318f29164d86520ac507cb248f6b2bff40a97fb30dc69feca35c
-
SSDEEP
6144:DXugYxZlG6D5tmBy03gWKrsYPPICn+ySgYr2Z+0mQy1CrxQqD9RSaSz+8O5+zdW:LulJKBhQyYHTYiZ+Qy18xQqpx8O5+J
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exedescription pid process target process PID 1760 wrote to memory of 1964 1760 d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe PID 1760 wrote to memory of 1964 1760 d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe PID 1760 wrote to memory of 1964 1760 d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe PID 1760 wrote to memory of 1964 1760 d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe PID 1760 wrote to memory of 1964 1760 d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe PID 1760 wrote to memory of 1964 1760 d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe PID 1760 wrote to memory of 1964 1760 d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe PID 1760 wrote to memory of 480 1760 d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe PID 1760 wrote to memory of 480 1760 d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe PID 1760 wrote to memory of 480 1760 d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe PID 1760 wrote to memory of 480 1760 d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe PID 1760 wrote to memory of 480 1760 d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe PID 1760 wrote to memory of 480 1760 d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe PID 1760 wrote to memory of 480 1760 d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe"C:\Users\Admin\AppData\Local\Temp\d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exestart2⤵
-
C:\Users\Admin\AppData\Local\Temp\d3672b866d21df5973a7063db73194311e3f76338e9849d389245fdcefa128f7.exewatch2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/480-56-0x0000000000000000-mapping.dmp
-
memory/480-60-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/480-64-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/480-66-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1760-54-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1760-55-0x0000000075281000-0x0000000075283000-memory.dmpFilesize
8KB
-
memory/1760-58-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1964-57-0x0000000000000000-mapping.dmp
-
memory/1964-59-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1964-63-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1964-65-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB