Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 12:35
Static task
static1
Behavioral task
behavioral1
Sample
fec06d4c263f7f25926d951a7e5ca0b2d682caffadd78785b8748619396495e6.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
fec06d4c263f7f25926d951a7e5ca0b2d682caffadd78785b8748619396495e6.exe
Resource
win10v2004-20220812-en
General
-
Target
fec06d4c263f7f25926d951a7e5ca0b2d682caffadd78785b8748619396495e6.exe
-
Size
524KB
-
MD5
56af622340eaaac76af0b259e980f342
-
SHA1
e320c2ad59dc956bc86104de791cec8eb7ee4427
-
SHA256
fec06d4c263f7f25926d951a7e5ca0b2d682caffadd78785b8748619396495e6
-
SHA512
d3e05847232509f752e4117b076da1288048e9bbcb1ff69bc1c6eb914a54949b464e4b56c1b3cfbf5d302137961bd1b2ecdbf6ac9483b325b9c3351c1d48f284
-
SSDEEP
12288:86vzfegzPMA7wL7cHeG4VzvBVKXCuapzDBGSd:rj9jHZ4VzvSXCXDVd
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
fec06d4c263f7f25926d951a7e5ca0b2d682caffadd78785b8748619396495e6.exedescription pid process target process PID 4168 wrote to memory of 3896 4168 fec06d4c263f7f25926d951a7e5ca0b2d682caffadd78785b8748619396495e6.exe fec06d4c263f7f25926d951a7e5ca0b2d682caffadd78785b8748619396495e6.exe PID 4168 wrote to memory of 3896 4168 fec06d4c263f7f25926d951a7e5ca0b2d682caffadd78785b8748619396495e6.exe fec06d4c263f7f25926d951a7e5ca0b2d682caffadd78785b8748619396495e6.exe PID 4168 wrote to memory of 3896 4168 fec06d4c263f7f25926d951a7e5ca0b2d682caffadd78785b8748619396495e6.exe fec06d4c263f7f25926d951a7e5ca0b2d682caffadd78785b8748619396495e6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fec06d4c263f7f25926d951a7e5ca0b2d682caffadd78785b8748619396495e6.exe"C:\Users\Admin\AppData\Local\Temp\fec06d4c263f7f25926d951a7e5ca0b2d682caffadd78785b8748619396495e6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\fec06d4c263f7f25926d951a7e5ca0b2d682caffadd78785b8748619396495e6.exetear2⤵PID:3896
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3896-132-0x0000000000000000-mapping.dmp
-
memory/3896-134-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/3896-135-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/3896-136-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/4168-133-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB