Analysis

  • max time kernel
    194s
  • max time network
    204s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 12:08

General

  • Target

    72b4d692ab0615299879a799faec735a0bf435cbafe11311e1e159fb00aedf3d.exe

  • Size

    518KB

  • MD5

    4614210853ab7f470b9a7e13921721c6

  • SHA1

    0230ae84ea07724af2e4eda2af42f4365d1fc0ce

  • SHA256

    72b4d692ab0615299879a799faec735a0bf435cbafe11311e1e159fb00aedf3d

  • SHA512

    952cc9c15bcd8a8fd33bc81e4b2cd0a101b3c135794ea04031f64907ffe5f9656e49836f968417736bafbf249d51bd664806abb1c61d746f0979aaad67538242

  • SSDEEP

    12288:5Ld8PaXr1HRgrdwYYlLPt5oKnWq39zbv:5Zy2r1blLPt5/WUv

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\72b4d692ab0615299879a799faec735a0bf435cbafe11311e1e159fb00aedf3d.exe
    "C:\Users\Admin\AppData\Local\Temp\72b4d692ab0615299879a799faec735a0bf435cbafe11311e1e159fb00aedf3d.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4900
    • C:\Users\Admin\AppData\Local\Temp\72b4d692ab0615299879a799faec735a0bf435cbafe11311e1e159fb00aedf3d.exe
      start
      2⤵
        PID:4668
      • C:\Users\Admin\AppData\Local\Temp\72b4d692ab0615299879a799faec735a0bf435cbafe11311e1e159fb00aedf3d.exe
        watch
        2⤵
          PID:1932

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1932-133-0x0000000000000000-mapping.dmp

      • memory/1932-137-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

      • memory/1932-139-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

      • memory/1932-141-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

      • memory/4668-134-0x0000000000000000-mapping.dmp

      • memory/4668-136-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

      • memory/4668-138-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

      • memory/4668-140-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

      • memory/4900-132-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

      • memory/4900-135-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB