Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 12:12
Static task
static1
Behavioral task
behavioral1
Sample
59eb2c7194a31c81c74aa1a8b99fb12a99a3521b069377489974fe3ac4a80258.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
59eb2c7194a31c81c74aa1a8b99fb12a99a3521b069377489974fe3ac4a80258.exe
Resource
win10v2004-20220812-en
General
-
Target
59eb2c7194a31c81c74aa1a8b99fb12a99a3521b069377489974fe3ac4a80258.exe
-
Size
518KB
-
MD5
08fe6541513a0a1661d0a97dd326366a
-
SHA1
69b44362c92a0ca352eea3f20e8a6d9b2269f81b
-
SHA256
59eb2c7194a31c81c74aa1a8b99fb12a99a3521b069377489974fe3ac4a80258
-
SHA512
99eb4f18199936eda50ba67f7374befa11e011c387cf0cedd75d65d18bad622bd4480a68f14ede5bfbffec87f7314c6a1d5b81161f6633d01a98773182d4e374
-
SSDEEP
12288:TCqd0pkJRYjwLpUJSwYYlLPt5oKnWq3nBb:WqfJRYjwLkDlLPt5/Wc
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
59eb2c7194a31c81c74aa1a8b99fb12a99a3521b069377489974fe3ac4a80258.exedescription pid process target process PID 2072 wrote to memory of 2604 2072 59eb2c7194a31c81c74aa1a8b99fb12a99a3521b069377489974fe3ac4a80258.exe 59eb2c7194a31c81c74aa1a8b99fb12a99a3521b069377489974fe3ac4a80258.exe PID 2072 wrote to memory of 2604 2072 59eb2c7194a31c81c74aa1a8b99fb12a99a3521b069377489974fe3ac4a80258.exe 59eb2c7194a31c81c74aa1a8b99fb12a99a3521b069377489974fe3ac4a80258.exe PID 2072 wrote to memory of 2604 2072 59eb2c7194a31c81c74aa1a8b99fb12a99a3521b069377489974fe3ac4a80258.exe 59eb2c7194a31c81c74aa1a8b99fb12a99a3521b069377489974fe3ac4a80258.exe PID 2072 wrote to memory of 2588 2072 59eb2c7194a31c81c74aa1a8b99fb12a99a3521b069377489974fe3ac4a80258.exe 59eb2c7194a31c81c74aa1a8b99fb12a99a3521b069377489974fe3ac4a80258.exe PID 2072 wrote to memory of 2588 2072 59eb2c7194a31c81c74aa1a8b99fb12a99a3521b069377489974fe3ac4a80258.exe 59eb2c7194a31c81c74aa1a8b99fb12a99a3521b069377489974fe3ac4a80258.exe PID 2072 wrote to memory of 2588 2072 59eb2c7194a31c81c74aa1a8b99fb12a99a3521b069377489974fe3ac4a80258.exe 59eb2c7194a31c81c74aa1a8b99fb12a99a3521b069377489974fe3ac4a80258.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\59eb2c7194a31c81c74aa1a8b99fb12a99a3521b069377489974fe3ac4a80258.exe"C:\Users\Admin\AppData\Local\Temp\59eb2c7194a31c81c74aa1a8b99fb12a99a3521b069377489974fe3ac4a80258.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\59eb2c7194a31c81c74aa1a8b99fb12a99a3521b069377489974fe3ac4a80258.exestart2⤵
-
C:\Users\Admin\AppData\Local\Temp\59eb2c7194a31c81c74aa1a8b99fb12a99a3521b069377489974fe3ac4a80258.exewatch2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2072-132-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/2072-135-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/2588-133-0x0000000000000000-mapping.dmp
-
memory/2588-136-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/2588-139-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/2604-134-0x0000000000000000-mapping.dmp
-
memory/2604-137-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/2604-138-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB