620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c

Analysis

max time kernel
52s
max time network
110s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 12:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe
Size

522KB
MD5

84b0b72a101164d648fd4d6646e49ae7
SHA1

ede45e64a51d7de94b9de691d982c2a3a89d60b1
SHA256

620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c
SHA512

93fb8d3aa006542c500d6e04a7c9fdfba52a568d537f5b49342e98a39acd550cfe156c386bcab26207056099314ec18247bc581f5021e6ce3f50390efae5f765
SSDEEP

12288:jIo5AwhTUQjK9Y+nAT8a5l8qy18xQqpx8O5fk:jI+JjKex8Iatqpx8f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe

description	pid	process	target process
PID 952 wrote to memory of 1180	952	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe
PID 952 wrote to memory of 1180	952	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe
PID 952 wrote to memory of 1180	952	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe
PID 952 wrote to memory of 1180	952	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe
PID 952 wrote to memory of 1180	952	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe
PID 952 wrote to memory of 1180	952	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe
PID 952 wrote to memory of 1180	952	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe
PID 952 wrote to memory of 344	952	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe
PID 952 wrote to memory of 344	952	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe
PID 952 wrote to memory of 344	952	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe
PID 952 wrote to memory of 344	952	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe
PID 952 wrote to memory of 344	952	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe
PID 952 wrote to memory of 344	952	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe
PID 952 wrote to memory of 344	952	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe

C:\Users\Admin\AppData\Local\Temp\620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe
"C:\Users\Admin\AppData\Local\Temp\620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:952

C:\Users\Admin\AppData\Local\Temp\620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe
start
2⤵
PID:1180

C:\Users\Admin\AppData\Local\Temp\620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe
watch
2⤵
PID:344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/344-57-0x0000000000000000-mapping.dmp

Download
memory/344-60-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/344-64-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/344-67-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/952-54-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/952-55-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/952-56-0x0000000075701000-0x0000000075703000-memory.dmp

Filesize
8KB

Download
memory/952-59-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1180-58-0x0000000000000000-mapping.dmp

Download
memory/1180-61-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1180-65-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1180-66-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download