Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 12:15
Static task
static1
Behavioral task
behavioral1
Sample
4ac21c4f4e2debb70e7294aee3ba957ad305e19d74bcf27d8468bd9e01266870.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4ac21c4f4e2debb70e7294aee3ba957ad305e19d74bcf27d8468bd9e01266870.exe
Resource
win10v2004-20220812-en
General
-
Target
4ac21c4f4e2debb70e7294aee3ba957ad305e19d74bcf27d8468bd9e01266870.exe
-
Size
518KB
-
MD5
3eb27eb5f9029fc4023a334ac763c4c3
-
SHA1
4aead1ed57f987e39e8774c4d0a34cc5863a707d
-
SHA256
4ac21c4f4e2debb70e7294aee3ba957ad305e19d74bcf27d8468bd9e01266870
-
SHA512
3a2c3739b354b4ee1861628bbb431eb4cc53dabf60dc1da2089c2ef8520d9217c40c3ce3dbc9139bcd03c59531e62700132892e040dd20f4c96b3e0b8562c4ab
-
SSDEEP
12288:CMcBckurs/4uL9wRPawYYlLPt5oKnWq3YIb:CMsczJVFblLPt5/W3w
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
4ac21c4f4e2debb70e7294aee3ba957ad305e19d74bcf27d8468bd9e01266870.exedescription pid process target process PID 4548 wrote to memory of 1084 4548 4ac21c4f4e2debb70e7294aee3ba957ad305e19d74bcf27d8468bd9e01266870.exe 4ac21c4f4e2debb70e7294aee3ba957ad305e19d74bcf27d8468bd9e01266870.exe PID 4548 wrote to memory of 1084 4548 4ac21c4f4e2debb70e7294aee3ba957ad305e19d74bcf27d8468bd9e01266870.exe 4ac21c4f4e2debb70e7294aee3ba957ad305e19d74bcf27d8468bd9e01266870.exe PID 4548 wrote to memory of 1084 4548 4ac21c4f4e2debb70e7294aee3ba957ad305e19d74bcf27d8468bd9e01266870.exe 4ac21c4f4e2debb70e7294aee3ba957ad305e19d74bcf27d8468bd9e01266870.exe PID 4548 wrote to memory of 1928 4548 4ac21c4f4e2debb70e7294aee3ba957ad305e19d74bcf27d8468bd9e01266870.exe 4ac21c4f4e2debb70e7294aee3ba957ad305e19d74bcf27d8468bd9e01266870.exe PID 4548 wrote to memory of 1928 4548 4ac21c4f4e2debb70e7294aee3ba957ad305e19d74bcf27d8468bd9e01266870.exe 4ac21c4f4e2debb70e7294aee3ba957ad305e19d74bcf27d8468bd9e01266870.exe PID 4548 wrote to memory of 1928 4548 4ac21c4f4e2debb70e7294aee3ba957ad305e19d74bcf27d8468bd9e01266870.exe 4ac21c4f4e2debb70e7294aee3ba957ad305e19d74bcf27d8468bd9e01266870.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ac21c4f4e2debb70e7294aee3ba957ad305e19d74bcf27d8468bd9e01266870.exe"C:\Users\Admin\AppData\Local\Temp\4ac21c4f4e2debb70e7294aee3ba957ad305e19d74bcf27d8468bd9e01266870.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4ac21c4f4e2debb70e7294aee3ba957ad305e19d74bcf27d8468bd9e01266870.exestart2⤵
-
C:\Users\Admin\AppData\Local\Temp\4ac21c4f4e2debb70e7294aee3ba957ad305e19d74bcf27d8468bd9e01266870.exewatch2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1084-133-0x0000000000000000-mapping.dmp
-
memory/1084-136-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1084-137-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1928-132-0x0000000000000000-mapping.dmp
-
memory/1928-135-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1928-138-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/4548-134-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB