Analysis

  • max time kernel
    29s
  • max time network
    35s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 13:04

General

  • Target

    cea11e4f6895e4d3b1a03847e5315c4371dd51f1a7fb32df6bf29cf8cc05d2b6.exe

  • Size

    521KB

  • MD5

    ce39b8a6288eaa1d94c4a2284881ce12

  • SHA1

    ef5d5bddd5825ec472ee838ad842a1e93bcd5d38

  • SHA256

    cea11e4f6895e4d3b1a03847e5315c4371dd51f1a7fb32df6bf29cf8cc05d2b6

  • SHA512

    e94a42246de4fd14b870763684fd8e09d295e275903cbc41150ca061529630c3855194d07c921e256597667e93da04e27d37738a6c8de303cdd20d10b2cf8cd5

  • SSDEEP

    6144:iFO4qa4CLcknMTn/VlI15axYpvQTGQTzItSU0LTL/7pv3Sg8Gf8yRtD3iBeJQG2L:iMufnMT/VIJNQotszwGexGWRLUrdJ

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cea11e4f6895e4d3b1a03847e5315c4371dd51f1a7fb32df6bf29cf8cc05d2b6.exe
    "C:\Users\Admin\AppData\Local\Temp\cea11e4f6895e4d3b1a03847e5315c4371dd51f1a7fb32df6bf29cf8cc05d2b6.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Users\Admin\AppData\Local\Temp\cea11e4f6895e4d3b1a03847e5315c4371dd51f1a7fb32df6bf29cf8cc05d2b6.exe
      start
      2⤵
        PID:2044
      • C:\Users\Admin\AppData\Local\Temp\cea11e4f6895e4d3b1a03847e5315c4371dd51f1a7fb32df6bf29cf8cc05d2b6.exe
        watch
        2⤵
          PID:1440

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1440-55-0x0000000000000000-mapping.dmp

      • memory/1440-60-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

      • memory/1440-64-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

      • memory/2024-54-0x0000000075C21000-0x0000000075C23000-memory.dmp

        Filesize

        8KB

      • memory/2024-57-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

      • memory/2044-56-0x0000000000000000-mapping.dmp

      • memory/2044-61-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

      • memory/2044-62-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB

      • memory/2044-63-0x0000000000400000-0x000000000048B000-memory.dmp

        Filesize

        556KB