6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6

Analysis

max time kernel
30s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 12:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe
Size

522KB
MD5

bcfb9fd9ce7a0ab1127940eaa39f9348
SHA1

eec262e9725917897732c75d5da3c130adc270de
SHA256

6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6
SHA512

40bb6056bf9fd882f7cf6a14ecd95d93f1982a56866604a914d28f1c8c8de0f46a4e0f01f5472983d76dc62435d8cf66715ddfa25cfe57f3c80155213b3fb0fa
SSDEEP

12288:mwwYTIvIOeA1Ojwr1MZ6EBKwYYlLPt5oKnWq3wbw:NIPJwwhq6E9lLPt5/Wdw

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe

description	pid	process	target process
PID 968 wrote to memory of 2036	968	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe
PID 968 wrote to memory of 2036	968	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe
PID 968 wrote to memory of 2036	968	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe
PID 968 wrote to memory of 2036	968	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe
PID 968 wrote to memory of 2036	968	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe
PID 968 wrote to memory of 2036	968	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe
PID 968 wrote to memory of 2036	968	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe
PID 968 wrote to memory of 1620	968	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe
PID 968 wrote to memory of 1620	968	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe
PID 968 wrote to memory of 1620	968	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe
PID 968 wrote to memory of 1620	968	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe
PID 968 wrote to memory of 1620	968	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe
PID 968 wrote to memory of 1620	968	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe
PID 968 wrote to memory of 1620	968	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe

C:\Users\Admin\AppData\Local\Temp\6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe
"C:\Users\Admin\AppData\Local\Temp\6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:968

C:\Users\Admin\AppData\Local\Temp\6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe
start
2⤵
PID:2036

C:\Users\Admin\AppData\Local\Temp\6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe
watch
2⤵
PID:1620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/968-54-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download
memory/968-57-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1620-55-0x0000000000000000-mapping.dmp

Download
memory/1620-61-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1620-63-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2036-56-0x0000000000000000-mapping.dmp

Download
memory/2036-60-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2036-62-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download