Analysis
-
max time kernel
36s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 12:15
Static task
static1
Behavioral task
behavioral1
Sample
48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe
Resource
win10v2004-20221111-en
General
-
Target
48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe
-
Size
518KB
-
MD5
90e6f2c96acc9ecec91a8f15f43f9348
-
SHA1
eff7c1a5e666436074b056fcf1933ff49b7e9bae
-
SHA256
48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf
-
SHA512
b528f22d3f2521e1bd332c44e8bf3b6527b83ce37bc1f9401333fd2a3a6e11e8a3e853b1ad4c3104990d41a4f2cf6d39460a6a19729727e20c56d22abee6b104
-
SSDEEP
12288:xIXrMWiyTPzt1CG27lkwXqwYYlLPt5oKnWq3Slbk:xITictQG8lkw7lLPt5/Wdk
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exedescription pid process target process PID 1612 wrote to memory of 1620 1612 48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe 48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe PID 1612 wrote to memory of 1620 1612 48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe 48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe PID 1612 wrote to memory of 1620 1612 48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe 48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe PID 1612 wrote to memory of 1620 1612 48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe 48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe PID 1612 wrote to memory of 1620 1612 48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe 48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe PID 1612 wrote to memory of 1620 1612 48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe 48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe PID 1612 wrote to memory of 1620 1612 48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe 48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe PID 1612 wrote to memory of 1952 1612 48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe 48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe PID 1612 wrote to memory of 1952 1612 48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe 48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe PID 1612 wrote to memory of 1952 1612 48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe 48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe PID 1612 wrote to memory of 1952 1612 48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe 48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe PID 1612 wrote to memory of 1952 1612 48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe 48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe PID 1612 wrote to memory of 1952 1612 48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe 48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe PID 1612 wrote to memory of 1952 1612 48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe 48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe"C:\Users\Admin\AppData\Local\Temp\48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exestart2⤵
-
C:\Users\Admin\AppData\Local\Temp\48a1a7a17938e9f94dced305b675a0a983fbeda873e602ac0c1cc8281a92ebdf.exewatch2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1612-54-0x0000000076681000-0x0000000076683000-memory.dmpFilesize
8KB
-
memory/1612-57-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1620-56-0x0000000000000000-mapping.dmp
-
memory/1620-61-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1620-62-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1952-55-0x0000000000000000-mapping.dmp
-
memory/1952-60-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1952-63-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB