77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d

Analysis

max time kernel
150s
max time network
237s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 12:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe
Size

522KB
MD5

03be308f79aaa1042dfb98b7e599a324
SHA1

b6ea78a6ad4741294cf5a3a54ef108abbb732df9
SHA256

77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d
SHA512

92280e9ce29b1b0715536705ce0451db9771222ea31645a79b21aaf2da15098c20451d652b0d2fa6c5a0742f663344e04d6400ad878b3f8f718963475ad44bbf
SSDEEP

12288:wyF2kzYSIAmyh/LZESx57y18xQqpx8O5Yu:Ck7zZEW7atqpx8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe

description	pid	process	target process
PID 1260 wrote to memory of 1496	1260	77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe	77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe
PID 1260 wrote to memory of 1496	1260	77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe	77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe
PID 1260 wrote to memory of 1496	1260	77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe	77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe
PID 1260 wrote to memory of 1496	1260	77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe	77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe
PID 1260 wrote to memory of 1496	1260	77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe	77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe
PID 1260 wrote to memory of 1496	1260	77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe	77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe
PID 1260 wrote to memory of 1496	1260	77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe	77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe
PID 1260 wrote to memory of 1824	1260	77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe	77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe
PID 1260 wrote to memory of 1824	1260	77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe	77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe
PID 1260 wrote to memory of 1824	1260	77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe	77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe
PID 1260 wrote to memory of 1824	1260	77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe	77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe
PID 1260 wrote to memory of 1824	1260	77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe	77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe
PID 1260 wrote to memory of 1824	1260	77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe	77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe
PID 1260 wrote to memory of 1824	1260	77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe	77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe

C:\Users\Admin\AppData\Local\Temp\77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe
"C:\Users\Admin\AppData\Local\Temp\77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1260

C:\Users\Admin\AppData\Local\Temp\77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe
start
2⤵
PID:1496

C:\Users\Admin\AppData\Local\Temp\77a85b0464881716c9e5557ddab5fe5f1af834db2df3bb66620280f309b38f1d.exe
watch
2⤵
PID:1824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1260-54-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1260-55-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1260-56-0x0000000075151000-0x0000000075153000-memory.dmp

Filesize
8KB

Download
memory/1260-59-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1496-58-0x0000000000000000-mapping.dmp

Download
memory/1496-61-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1496-65-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1496-66-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1824-57-0x0000000000000000-mapping.dmp

Download
memory/1824-60-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1824-64-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1824-67-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download