69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89

Analysis

max time kernel
63s
max time network
119s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 12:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe
Size

522KB
MD5

4c8f8d0e158aca4e3212fbcf3567f3e6
SHA1

ceb52b66c49d5842ef5cedd4f531d5a6a071cdae
SHA256

69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89
SHA512

489d44432684d7c916d1de5543dd3dd6805467406d98c83210b152071ae72d455cd180482b299b76603906aa292f26942571fdd5e2d7fea33767132b1d630101
SSDEEP

6144:g8SsXYqyNnaWbc/DWzzl4/HeAhxK28IoyWHvtHpiqxB1LsmQy1CrxQqD9RSaSz+U:EsXHyjxcDK28PTPt54y18xQqpx8O5M

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe

description	pid	process	target process
PID 1256 wrote to memory of 1336	1256	69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe	69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe
PID 1256 wrote to memory of 1336	1256	69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe	69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe
PID 1256 wrote to memory of 1336	1256	69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe	69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe
PID 1256 wrote to memory of 1336	1256	69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe	69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe
PID 1256 wrote to memory of 1336	1256	69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe	69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe
PID 1256 wrote to memory of 1336	1256	69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe	69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe
PID 1256 wrote to memory of 1336	1256	69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe	69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe
PID 1256 wrote to memory of 832	1256	69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe	69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe
PID 1256 wrote to memory of 832	1256	69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe	69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe
PID 1256 wrote to memory of 832	1256	69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe	69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe
PID 1256 wrote to memory of 832	1256	69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe	69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe
PID 1256 wrote to memory of 832	1256	69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe	69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe
PID 1256 wrote to memory of 832	1256	69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe	69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe
PID 1256 wrote to memory of 832	1256	69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe	69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe

C:\Users\Admin\AppData\Local\Temp\69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe
"C:\Users\Admin\AppData\Local\Temp\69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1256

C:\Users\Admin\AppData\Local\Temp\69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe
start
2⤵
PID:1336

C:\Users\Admin\AppData\Local\Temp\69bfa5a7dde806cf1f95472d1f72da044a7cf15ff95dd3dd1d6b4350822f4b89.exe
watch
2⤵
PID:832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/832-65-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/832-56-0x0000000000000000-mapping.dmp

Download
memory/832-59-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/832-68-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/832-62-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1256-55-0x0000000075BE1000-0x0000000075BE3000-memory.dmp

Filesize
8KB

Download
memory/1256-54-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1256-58-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1336-57-0x0000000000000000-mapping.dmp

Download
memory/1336-64-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1336-66-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1336-67-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1336-60-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download