Analysis
-
max time kernel
39s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 13:47
Static task
static1
Behavioral task
behavioral1
Sample
85922979601ca2391b53181bdfba4afd4c6a35213ca0f81363e70615fa264282.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
85922979601ca2391b53181bdfba4afd4c6a35213ca0f81363e70615fa264282.exe
Resource
win10v2004-20221111-en
General
-
Target
85922979601ca2391b53181bdfba4afd4c6a35213ca0f81363e70615fa264282.exe
-
Size
524KB
-
MD5
a1f5127ba8decd5b3b8a672aa38982e9
-
SHA1
13985090b380d67df6c813f6e4283ac22b5382ae
-
SHA256
85922979601ca2391b53181bdfba4afd4c6a35213ca0f81363e70615fa264282
-
SHA512
97b1ae67be765fb23c854e7f7edc307471943216736cf8dbbd45afc08cc536332fb658557528551489cc64ad91394746ca6700537b01f39fcad41b06ab096cbb
-
SSDEEP
12288:+4LS4s4yeKEz4Bq9vlIW2Y/2/VzvBVKXCuapzDBG:vSBGKhq9vlgYoVzvSXCXD
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
85922979601ca2391b53181bdfba4afd4c6a35213ca0f81363e70615fa264282.exedescription pid process target process PID 1476 wrote to memory of 884 1476 85922979601ca2391b53181bdfba4afd4c6a35213ca0f81363e70615fa264282.exe 85922979601ca2391b53181bdfba4afd4c6a35213ca0f81363e70615fa264282.exe PID 1476 wrote to memory of 884 1476 85922979601ca2391b53181bdfba4afd4c6a35213ca0f81363e70615fa264282.exe 85922979601ca2391b53181bdfba4afd4c6a35213ca0f81363e70615fa264282.exe PID 1476 wrote to memory of 884 1476 85922979601ca2391b53181bdfba4afd4c6a35213ca0f81363e70615fa264282.exe 85922979601ca2391b53181bdfba4afd4c6a35213ca0f81363e70615fa264282.exe PID 1476 wrote to memory of 884 1476 85922979601ca2391b53181bdfba4afd4c6a35213ca0f81363e70615fa264282.exe 85922979601ca2391b53181bdfba4afd4c6a35213ca0f81363e70615fa264282.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\85922979601ca2391b53181bdfba4afd4c6a35213ca0f81363e70615fa264282.exe"C:\Users\Admin\AppData\Local\Temp\85922979601ca2391b53181bdfba4afd4c6a35213ca0f81363e70615fa264282.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\85922979601ca2391b53181bdfba4afd4c6a35213ca0f81363e70615fa264282.exetear2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/884-55-0x0000000000000000-mapping.dmp
-
memory/884-57-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/884-59-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/884-60-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1476-54-0x0000000075E51000-0x0000000075E53000-memory.dmpFilesize
8KB
-
memory/1476-56-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB