Analysis
-
max time kernel
41s -
max time network
87s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 13:40
Static task
static1
Behavioral task
behavioral1
Sample
90319a0861af2d314526d26f90cf3d4e903cde9fa9b1b13e04a9d4542f2f6829.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
90319a0861af2d314526d26f90cf3d4e903cde9fa9b1b13e04a9d4542f2f6829.exe
Resource
win10v2004-20221111-en
General
-
Target
90319a0861af2d314526d26f90cf3d4e903cde9fa9b1b13e04a9d4542f2f6829.exe
-
Size
537KB
-
MD5
e3eab511f145f88e92e05bb441a3eb85
-
SHA1
8941abe2cb63b4a4a7d0bc7a9c6289bf3cb50223
-
SHA256
90319a0861af2d314526d26f90cf3d4e903cde9fa9b1b13e04a9d4542f2f6829
-
SHA512
6900e27bae12a472917f65dd7cf0f0b7134356c4cc2b68ee8cb094df922f8f3992a5242bbfec136eb36a6294ac16124a36c1cd650a4f4f4b8535347e43548e72
-
SSDEEP
12288:gYObs02VAWlKqb8kSzCIk1MpyCqi8ka8nmCEJdTye63QmeS:yCrlKFN01MpXqi8kJcDmeS
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
90319a0861af2d314526d26f90cf3d4e903cde9fa9b1b13e04a9d4542f2f6829.exedescription pid process target process PID 1628 wrote to memory of 1600 1628 90319a0861af2d314526d26f90cf3d4e903cde9fa9b1b13e04a9d4542f2f6829.exe 90319a0861af2d314526d26f90cf3d4e903cde9fa9b1b13e04a9d4542f2f6829.exe PID 1628 wrote to memory of 1600 1628 90319a0861af2d314526d26f90cf3d4e903cde9fa9b1b13e04a9d4542f2f6829.exe 90319a0861af2d314526d26f90cf3d4e903cde9fa9b1b13e04a9d4542f2f6829.exe PID 1628 wrote to memory of 1600 1628 90319a0861af2d314526d26f90cf3d4e903cde9fa9b1b13e04a9d4542f2f6829.exe 90319a0861af2d314526d26f90cf3d4e903cde9fa9b1b13e04a9d4542f2f6829.exe PID 1628 wrote to memory of 1600 1628 90319a0861af2d314526d26f90cf3d4e903cde9fa9b1b13e04a9d4542f2f6829.exe 90319a0861af2d314526d26f90cf3d4e903cde9fa9b1b13e04a9d4542f2f6829.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\90319a0861af2d314526d26f90cf3d4e903cde9fa9b1b13e04a9d4542f2f6829.exe"C:\Users\Admin\AppData\Local\Temp\90319a0861af2d314526d26f90cf3d4e903cde9fa9b1b13e04a9d4542f2f6829.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\90319a0861af2d314526d26f90cf3d4e903cde9fa9b1b13e04a9d4542f2f6829.exetear2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1600-56-0x0000000000000000-mapping.dmp
-
memory/1600-59-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/1600-60-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/1628-54-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/1628-55-0x0000000075BE1000-0x0000000075BE3000-memory.dmpFilesize
8KB
-
memory/1628-57-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB