Analysis
-
max time kernel
205s -
max time network
211s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 12:07
Static task
static1
Behavioral task
behavioral1
Sample
76c11416909b8942f6d7fbf8c3851b0a292a96718ca05177a79fc93c7a28fb2b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
76c11416909b8942f6d7fbf8c3851b0a292a96718ca05177a79fc93c7a28fb2b.exe
Resource
win10v2004-20221111-en
General
-
Target
76c11416909b8942f6d7fbf8c3851b0a292a96718ca05177a79fc93c7a28fb2b.exe
-
Size
522KB
-
MD5
e225d069e8c51105812cfb4b87c19fcd
-
SHA1
15a9e9792cee33d9b0c3fa66415fd5aff0fe2ac0
-
SHA256
76c11416909b8942f6d7fbf8c3851b0a292a96718ca05177a79fc93c7a28fb2b
-
SHA512
12b171760462924f1f593521dcbcae93da5818aa27477bc6065b51e0b866d8c8b47f349573e3da5a22f93fd5cc7cc2b488de12588b35cf997b15895603947a7d
-
SSDEEP
12288:xTTVtkl/ZYyGCp2zjwRjwYYlLPt5oKnWq39bY:xPk9ayhgwalLPt5/WYY
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
76c11416909b8942f6d7fbf8c3851b0a292a96718ca05177a79fc93c7a28fb2b.exedescription pid process target process PID 4972 wrote to memory of 3844 4972 76c11416909b8942f6d7fbf8c3851b0a292a96718ca05177a79fc93c7a28fb2b.exe 76c11416909b8942f6d7fbf8c3851b0a292a96718ca05177a79fc93c7a28fb2b.exe PID 4972 wrote to memory of 3844 4972 76c11416909b8942f6d7fbf8c3851b0a292a96718ca05177a79fc93c7a28fb2b.exe 76c11416909b8942f6d7fbf8c3851b0a292a96718ca05177a79fc93c7a28fb2b.exe PID 4972 wrote to memory of 3844 4972 76c11416909b8942f6d7fbf8c3851b0a292a96718ca05177a79fc93c7a28fb2b.exe 76c11416909b8942f6d7fbf8c3851b0a292a96718ca05177a79fc93c7a28fb2b.exe PID 4972 wrote to memory of 1408 4972 76c11416909b8942f6d7fbf8c3851b0a292a96718ca05177a79fc93c7a28fb2b.exe 76c11416909b8942f6d7fbf8c3851b0a292a96718ca05177a79fc93c7a28fb2b.exe PID 4972 wrote to memory of 1408 4972 76c11416909b8942f6d7fbf8c3851b0a292a96718ca05177a79fc93c7a28fb2b.exe 76c11416909b8942f6d7fbf8c3851b0a292a96718ca05177a79fc93c7a28fb2b.exe PID 4972 wrote to memory of 1408 4972 76c11416909b8942f6d7fbf8c3851b0a292a96718ca05177a79fc93c7a28fb2b.exe 76c11416909b8942f6d7fbf8c3851b0a292a96718ca05177a79fc93c7a28fb2b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\76c11416909b8942f6d7fbf8c3851b0a292a96718ca05177a79fc93c7a28fb2b.exe"C:\Users\Admin\AppData\Local\Temp\76c11416909b8942f6d7fbf8c3851b0a292a96718ca05177a79fc93c7a28fb2b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\76c11416909b8942f6d7fbf8c3851b0a292a96718ca05177a79fc93c7a28fb2b.exestart2⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\76c11416909b8942f6d7fbf8c3851b0a292a96718ca05177a79fc93c7a28fb2b.exewatch2⤵PID:1408
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1408-132-0x0000000000000000-mapping.dmp
-
memory/1408-137-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1408-138-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1408-140-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1408-142-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/3844-133-0x0000000000000000-mapping.dmp
-
memory/3844-136-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/3844-139-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/3844-141-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/4972-134-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/4972-135-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB