92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe
Size

522KB
MD5

7dd69d56411d8852ac2ac60de4e78404
SHA1

307f6f29753d7e1ce842a1bd21275d6f0e4f8e67
SHA256

92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c
SHA512

c481910309fedd3285d3b9f1c592b928e1a70d77852410d5bb59cb8f61ebf1310390f9721656126971a0ddcecfeb46ba844403ddf18d2550966da54b57d58fb2
SSDEEP

6144:DL1niHQFGsvxbtbvpMwyNq2XklaaHNxQ0K0SD2wQ7CaqpUxdrZPkTY/210YO9ALJ:3QqziXmBQ3Q7CDpwtWsjYO9AtwR6y

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe

description	pid	process	target process
PID 1096 wrote to memory of 2036	1096	92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe	92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe
PID 1096 wrote to memory of 2036	1096	92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe	92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe
PID 1096 wrote to memory of 2036	1096	92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe	92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe
PID 1096 wrote to memory of 2036	1096	92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe	92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe
PID 1096 wrote to memory of 2036	1096	92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe	92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe
PID 1096 wrote to memory of 2036	1096	92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe	92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe
PID 1096 wrote to memory of 2036	1096	92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe	92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe
PID 1096 wrote to memory of 2024	1096	92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe	92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe
PID 1096 wrote to memory of 2024	1096	92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe	92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe
PID 1096 wrote to memory of 2024	1096	92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe	92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe
PID 1096 wrote to memory of 2024	1096	92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe	92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe
PID 1096 wrote to memory of 2024	1096	92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe	92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe
PID 1096 wrote to memory of 2024	1096	92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe	92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe
PID 1096 wrote to memory of 2024	1096	92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe	92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe

C:\Users\Admin\AppData\Local\Temp\92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe
"C:\Users\Admin\AppData\Local\Temp\92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1096

C:\Users\Admin\AppData\Local\Temp\92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe
start
2⤵
PID:2036

C:\Users\Admin\AppData\Local\Temp\92dd94860f3780a7c3bb4c9eb1a95bd5114048370211f8d07e49a007b58e4a0c.exe
watch
2⤵
PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1096-54-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1096-55-0x0000000075C41000-0x0000000075C43000-memory.dmp

Filesize
8KB

Download
memory/1096-58-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2024-56-0x0000000000000000-mapping.dmp

Download
memory/2024-61-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2024-65-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2036-57-0x0000000000000000-mapping.dmp

Download
memory/2036-63-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2036-62-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2036-64-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download