Analysis

  • max time kernel
    47s
  • max time network
    57s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 13:48

General

  • Target

    84c731704dd8a583e04637130ccfc449eee7f3d5c5fc80953e0c3bee539b4631.exe

  • Size

    522KB

  • MD5

    7f36dd73b7d47e9e99957146c6e8dbc3

  • SHA1

    a6d733ce0881ff062b03aeb1aaaea32e6526792b

  • SHA256

    84c731704dd8a583e04637130ccfc449eee7f3d5c5fc80953e0c3bee539b4631

  • SHA512

    49cba8e62ccf234ef0560f318302c014e9faf01b81ebf6ce184b8e473fa47510c1582109c2a926dbe17261a781d2dcf69534433a6728345c873a621c6eb4b55f

  • SSDEEP

    12288:6bgu89NpA+S+nPCzxo4xUupSMrFCsNEfF4SKt:Tu8RS+nqG4quouFCsNaHK

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\84c731704dd8a583e04637130ccfc449eee7f3d5c5fc80953e0c3bee539b4631.exe
    "C:\Users\Admin\AppData\Local\Temp\84c731704dd8a583e04637130ccfc449eee7f3d5c5fc80953e0c3bee539b4631.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Users\Admin\AppData\Local\Temp\84c731704dd8a583e04637130ccfc449eee7f3d5c5fc80953e0c3bee539b4631.exe
      start
      2⤵
        PID:1788
      • C:\Users\Admin\AppData\Local\Temp\84c731704dd8a583e04637130ccfc449eee7f3d5c5fc80953e0c3bee539b4631.exe
        watch
        2⤵
          PID:1252

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1252-55-0x0000000000000000-mapping.dmp

      • memory/1252-60-0x0000000000400000-0x000000000048C000-memory.dmp

        Filesize

        560KB

      • memory/1252-62-0x0000000000400000-0x000000000048C000-memory.dmp

        Filesize

        560KB

      • memory/1252-65-0x0000000000400000-0x000000000048C000-memory.dmp

        Filesize

        560KB

      • memory/1788-56-0x0000000000000000-mapping.dmp

      • memory/1788-61-0x0000000000400000-0x000000000048C000-memory.dmp

        Filesize

        560KB

      • memory/1788-63-0x0000000000400000-0x000000000048C000-memory.dmp

        Filesize

        560KB

      • memory/1788-64-0x0000000000400000-0x000000000048C000-memory.dmp

        Filesize

        560KB

      • memory/2024-54-0x00000000760D1000-0x00000000760D3000-memory.dmp

        Filesize

        8KB

      • memory/2024-57-0x0000000000400000-0x000000000048C000-memory.dmp

        Filesize

        560KB