77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0

Analysis

max time kernel
42s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 12:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe
Size

518KB
MD5

797974da79fb5017d2f0beff348b8813
SHA1

deaa904d15226c14496e36440ef9219ef77140ee
SHA256

77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0
SHA512

55ace64b6cea981001e07d4109ef3bf9f503da41162958e69e8641f35f4ea0f0bb73b98328ad36f0a2c75924427e1fad00e2bfd5e6b2906396e456317cfcf368
SSDEEP

12288:qnWBdz04JnDqT2QWwYYlLPt5oKnWq3gbz6C:fBdz0MuflLPt5/WZz

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe

description	pid	process	target process
PID 1720 wrote to memory of 1284	1720	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe
PID 1720 wrote to memory of 1284	1720	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe
PID 1720 wrote to memory of 1284	1720	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe
PID 1720 wrote to memory of 1284	1720	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe
PID 1720 wrote to memory of 1284	1720	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe
PID 1720 wrote to memory of 1284	1720	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe
PID 1720 wrote to memory of 1284	1720	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe
PID 1720 wrote to memory of 1356	1720	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe
PID 1720 wrote to memory of 1356	1720	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe
PID 1720 wrote to memory of 1356	1720	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe
PID 1720 wrote to memory of 1356	1720	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe
PID 1720 wrote to memory of 1356	1720	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe
PID 1720 wrote to memory of 1356	1720	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe
PID 1720 wrote to memory of 1356	1720	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe

C:\Users\Admin\AppData\Local\Temp\77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe
"C:\Users\Admin\AppData\Local\Temp\77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1720

C:\Users\Admin\AppData\Local\Temp\77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe
start
2⤵
PID:1284

C:\Users\Admin\AppData\Local\Temp\77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe
watch
2⤵
PID:1356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1284-56-0x0000000000000000-mapping.dmp

Download
memory/1284-61-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1284-62-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1356-55-0x0000000000000000-mapping.dmp

Download
memory/1356-60-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1356-63-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1720-54-0x00000000765B1000-0x00000000765B3000-memory.dmp

Filesize
8KB

Download
memory/1720-57-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download