6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992

Analysis

max time kernel
31s
max time network
40s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 12:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe
Size

518KB
MD5

af57a34fb4c06c16429f155e36763558
SHA1

3039548364e9d6bd9b5194ef0b6048aa5f224e31
SHA256

6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992
SHA512

44bbaaf2d4ca435bc305f48b0fee0ab04bb051b7a76aa06ac84c8d406553e845ad36321831dfd6eaa6f3bc90e85acb4f7db66747f3161ee321c0de533f272c4e
SSDEEP

12288:/uMFKJMG72Z5hfFfyw3PwYYlLPt5oKnWq37cby:/dFZFGlLPt5/WaMy

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe

description	pid	process	target process
PID 1444 wrote to memory of 2024	1444	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe
PID 1444 wrote to memory of 2024	1444	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe
PID 1444 wrote to memory of 2024	1444	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe
PID 1444 wrote to memory of 2024	1444	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe
PID 1444 wrote to memory of 2024	1444	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe
PID 1444 wrote to memory of 2024	1444	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe
PID 1444 wrote to memory of 2024	1444	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe
PID 1444 wrote to memory of 1172	1444	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe
PID 1444 wrote to memory of 1172	1444	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe
PID 1444 wrote to memory of 1172	1444	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe
PID 1444 wrote to memory of 1172	1444	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe
PID 1444 wrote to memory of 1172	1444	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe
PID 1444 wrote to memory of 1172	1444	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe
PID 1444 wrote to memory of 1172	1444	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe

C:\Users\Admin\AppData\Local\Temp\6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe
"C:\Users\Admin\AppData\Local\Temp\6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1444

C:\Users\Admin\AppData\Local\Temp\6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe
start
2⤵
PID:2024

C:\Users\Admin\AppData\Local\Temp\6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe
watch
2⤵
PID:1172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1172-56-0x0000000000000000-mapping.dmp

Download
memory/1172-62-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1172-64-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1444-54-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1444-55-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download
memory/1444-58-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2024-57-0x0000000000000000-mapping.dmp

Download
memory/2024-61-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2024-63-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download