Analysis
-
max time kernel
107s -
max time network
343s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 13:25
Static task
static1
Behavioral task
behavioral1
Sample
abc5b5375fd218e238b339da6fff33e04a413c706fe2ad5d709f9473033109a7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
abc5b5375fd218e238b339da6fff33e04a413c706fe2ad5d709f9473033109a7.exe
Resource
win10v2004-20221111-en
General
-
Target
abc5b5375fd218e238b339da6fff33e04a413c706fe2ad5d709f9473033109a7.exe
-
Size
522KB
-
MD5
66aa82713b4515fc81ade9f2b3fae805
-
SHA1
e6d4f1dfed479268fdf037195a438598e4acf2db
-
SHA256
abc5b5375fd218e238b339da6fff33e04a413c706fe2ad5d709f9473033109a7
-
SHA512
7fcd50e5644a53513cc44e08df973222e2bf00f561bb9c52d12f01aa3f9cd45fc2166a45a172da306e9813426a4b4d28338c9500731d6a824ca9b4ad49f3171a
-
SSDEEP
12288:5E+RZE4a3P2jZNp+GbCyDpwtWsjYO9AtwB:jP828G2yCrkO9qw
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
abc5b5375fd218e238b339da6fff33e04a413c706fe2ad5d709f9473033109a7.exedescription pid process target process PID 4136 wrote to memory of 964 4136 abc5b5375fd218e238b339da6fff33e04a413c706fe2ad5d709f9473033109a7.exe abc5b5375fd218e238b339da6fff33e04a413c706fe2ad5d709f9473033109a7.exe PID 4136 wrote to memory of 964 4136 abc5b5375fd218e238b339da6fff33e04a413c706fe2ad5d709f9473033109a7.exe abc5b5375fd218e238b339da6fff33e04a413c706fe2ad5d709f9473033109a7.exe PID 4136 wrote to memory of 964 4136 abc5b5375fd218e238b339da6fff33e04a413c706fe2ad5d709f9473033109a7.exe abc5b5375fd218e238b339da6fff33e04a413c706fe2ad5d709f9473033109a7.exe PID 4136 wrote to memory of 4800 4136 abc5b5375fd218e238b339da6fff33e04a413c706fe2ad5d709f9473033109a7.exe abc5b5375fd218e238b339da6fff33e04a413c706fe2ad5d709f9473033109a7.exe PID 4136 wrote to memory of 4800 4136 abc5b5375fd218e238b339da6fff33e04a413c706fe2ad5d709f9473033109a7.exe abc5b5375fd218e238b339da6fff33e04a413c706fe2ad5d709f9473033109a7.exe PID 4136 wrote to memory of 4800 4136 abc5b5375fd218e238b339da6fff33e04a413c706fe2ad5d709f9473033109a7.exe abc5b5375fd218e238b339da6fff33e04a413c706fe2ad5d709f9473033109a7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\abc5b5375fd218e238b339da6fff33e04a413c706fe2ad5d709f9473033109a7.exe"C:\Users\Admin\AppData\Local\Temp\abc5b5375fd218e238b339da6fff33e04a413c706fe2ad5d709f9473033109a7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\abc5b5375fd218e238b339da6fff33e04a413c706fe2ad5d709f9473033109a7.exestart2⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\abc5b5375fd218e238b339da6fff33e04a413c706fe2ad5d709f9473033109a7.exewatch2⤵PID:4800
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/964-134-0x0000000000000000-mapping.dmp
-
memory/964-137-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/964-139-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/964-140-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4136-132-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4136-135-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4800-133-0x0000000000000000-mapping.dmp
-
memory/4800-136-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4800-138-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4800-141-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB