Analysis

  • max time kernel
    315s
  • max time network
    365s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 12:08

General

  • Target

    714af4ac48df646df9fca4fc4ac5c6f8587f79d43e8d2f7deec4f67b2cc7aac6.exe

  • Size

    518KB

  • MD5

    3ff73af605e2707be38cfa7e7a663791

  • SHA1

    d9f1d4a3ffc56ff15f76dccafb1ae392fa08c944

  • SHA256

    714af4ac48df646df9fca4fc4ac5c6f8587f79d43e8d2f7deec4f67b2cc7aac6

  • SHA512

    0a75c6f686181465dca4d264825f99316ba15cb6b806fe7890f489ff399c0ff7463d7730afc2416975312a0c55abf57af2adef33bdf5053c5d1d4fc11e655777

  • SSDEEP

    12288:q/LUh610i+yDBNiI2lwYYlLPt5oKnWq3tbl:q/Q61ZNBNzlLPt5/Wcl

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\714af4ac48df646df9fca4fc4ac5c6f8587f79d43e8d2f7deec4f67b2cc7aac6.exe
    "C:\Users\Admin\AppData\Local\Temp\714af4ac48df646df9fca4fc4ac5c6f8587f79d43e8d2f7deec4f67b2cc7aac6.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4228
    • C:\Users\Admin\AppData\Local\Temp\714af4ac48df646df9fca4fc4ac5c6f8587f79d43e8d2f7deec4f67b2cc7aac6.exe
      start
      2⤵
        PID:3624
      • C:\Users\Admin\AppData\Local\Temp\714af4ac48df646df9fca4fc4ac5c6f8587f79d43e8d2f7deec4f67b2cc7aac6.exe
        watch
        2⤵
          PID:2500

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2500-134-0x0000000000000000-mapping.dmp

      • memory/2500-137-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

      • memory/2500-139-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

      • memory/2500-141-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

      • memory/3624-135-0x0000000000000000-mapping.dmp

      • memory/3624-138-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

      • memory/3624-140-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

      • memory/4228-132-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

      • memory/4228-133-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

      • memory/4228-136-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB