Analysis
-
max time kernel
34s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 12:40
Static task
static1
Behavioral task
behavioral1
Sample
f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe
Resource
win10v2004-20221111-en
General
-
Target
f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe
-
Size
522KB
-
MD5
6e2545c5dcfcd4cf3048ff2cd4a24f78
-
SHA1
6a440a970aa5e1f55b5d2dc61915e9c29b4ab579
-
SHA256
f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29
-
SHA512
1be3078233020c612f6ebb73d47d686fd56ea29593bed645c6c5101862050b2dd0d007c4d86f70aaaf1e4e2819115c453255ae5518338f9f4afe649aceeabb5f
-
SSDEEP
6144:evyTC2JoL70xtttUKXntQdbJDHHCoooX0R7ktmQy1CrxQqD9RSaSz+8O5kzxW:6kCVLAttKAQ7hoy0Rmy18xQqpx8O5kl
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exedescription pid process target process PID 1452 wrote to memory of 1964 1452 f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe PID 1452 wrote to memory of 1964 1452 f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe PID 1452 wrote to memory of 1964 1452 f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe PID 1452 wrote to memory of 1964 1452 f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe PID 1452 wrote to memory of 1964 1452 f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe PID 1452 wrote to memory of 1964 1452 f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe PID 1452 wrote to memory of 1964 1452 f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe PID 1452 wrote to memory of 1276 1452 f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe PID 1452 wrote to memory of 1276 1452 f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe PID 1452 wrote to memory of 1276 1452 f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe PID 1452 wrote to memory of 1276 1452 f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe PID 1452 wrote to memory of 1276 1452 f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe PID 1452 wrote to memory of 1276 1452 f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe PID 1452 wrote to memory of 1276 1452 f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe"C:\Users\Admin\AppData\Local\Temp\f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exestart2⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\f7fc723c3df053c0a6580f090917e2bf52cf216e36a59ebc70cc8c0c27b2bf29.exewatch2⤵PID:1276
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1276-56-0x0000000000000000-mapping.dmp
-
memory/1276-59-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1276-63-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1276-66-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1452-54-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1452-55-0x0000000075041000-0x0000000075043000-memory.dmpFilesize
8KB
-
memory/1452-58-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1964-57-0x0000000000000000-mapping.dmp
-
memory/1964-60-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1964-64-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1964-65-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB