Analysis
-
max time kernel
163s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 12:09
Static task
static1
Behavioral task
behavioral1
Sample
6bf4db50d6dcf6422de753d0ba0419855f4f83bf30e6302c80d597ccdbd2c33f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6bf4db50d6dcf6422de753d0ba0419855f4f83bf30e6302c80d597ccdbd2c33f.exe
Resource
win10v2004-20220812-en
General
-
Target
6bf4db50d6dcf6422de753d0ba0419855f4f83bf30e6302c80d597ccdbd2c33f.exe
-
Size
522KB
-
MD5
76c2c084d5a19e9bf1167f9da7e7b7cf
-
SHA1
7674e83d26d65f0929ef8e417b58ee01d7380dfc
-
SHA256
6bf4db50d6dcf6422de753d0ba0419855f4f83bf30e6302c80d597ccdbd2c33f
-
SHA512
83d7a445a363205f860d4954a27c84d1491ed8a6d17253000f9a0225ace58a238f6944f84e4f4f2ed3e5a2aa03f9018afaedfc7f7ffc20acf398dc2afede5fe4
-
SSDEEP
6144:ga563ZRXBSisDStl+cxqFJtS+/o86DSs0M3rjg+fMmQy1CrxQqD9RSaSz+8O53hz:wXBXMmIc1WAOy18xQqpx8O53
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
6bf4db50d6dcf6422de753d0ba0419855f4f83bf30e6302c80d597ccdbd2c33f.exedescription pid process target process PID 460 wrote to memory of 4060 460 6bf4db50d6dcf6422de753d0ba0419855f4f83bf30e6302c80d597ccdbd2c33f.exe 6bf4db50d6dcf6422de753d0ba0419855f4f83bf30e6302c80d597ccdbd2c33f.exe PID 460 wrote to memory of 4060 460 6bf4db50d6dcf6422de753d0ba0419855f4f83bf30e6302c80d597ccdbd2c33f.exe 6bf4db50d6dcf6422de753d0ba0419855f4f83bf30e6302c80d597ccdbd2c33f.exe PID 460 wrote to memory of 4060 460 6bf4db50d6dcf6422de753d0ba0419855f4f83bf30e6302c80d597ccdbd2c33f.exe 6bf4db50d6dcf6422de753d0ba0419855f4f83bf30e6302c80d597ccdbd2c33f.exe PID 460 wrote to memory of 1340 460 6bf4db50d6dcf6422de753d0ba0419855f4f83bf30e6302c80d597ccdbd2c33f.exe 6bf4db50d6dcf6422de753d0ba0419855f4f83bf30e6302c80d597ccdbd2c33f.exe PID 460 wrote to memory of 1340 460 6bf4db50d6dcf6422de753d0ba0419855f4f83bf30e6302c80d597ccdbd2c33f.exe 6bf4db50d6dcf6422de753d0ba0419855f4f83bf30e6302c80d597ccdbd2c33f.exe PID 460 wrote to memory of 1340 460 6bf4db50d6dcf6422de753d0ba0419855f4f83bf30e6302c80d597ccdbd2c33f.exe 6bf4db50d6dcf6422de753d0ba0419855f4f83bf30e6302c80d597ccdbd2c33f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6bf4db50d6dcf6422de753d0ba0419855f4f83bf30e6302c80d597ccdbd2c33f.exe"C:\Users\Admin\AppData\Local\Temp\6bf4db50d6dcf6422de753d0ba0419855f4f83bf30e6302c80d597ccdbd2c33f.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6bf4db50d6dcf6422de753d0ba0419855f4f83bf30e6302c80d597ccdbd2c33f.exestart2⤵
-
C:\Users\Admin\AppData\Local\Temp\6bf4db50d6dcf6422de753d0ba0419855f4f83bf30e6302c80d597ccdbd2c33f.exewatch2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/460-132-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/460-135-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1340-133-0x0000000000000000-mapping.dmp
-
memory/1340-136-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1340-138-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1340-141-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4060-134-0x0000000000000000-mapping.dmp
-
memory/4060-137-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4060-139-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4060-140-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB