2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe
Size

522KB
MD5

2705e3e3416d6ff65ee39564f582a3d7
SHA1

3ba25880667a804b01528da4033c6e542b824588
SHA256

2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a
SHA512

fe07c28a4f938b1c04deae4ddbcf2f2c72e8ec137c1bbd427a151030025e70eb38b6491a4e327a37febd1cb417ba8cb20eee57fb3d712f78ec5f84220434993f
SSDEEP

6144:O9TDTBiIQLA0ersSwQM7CrNycmwRSGQ7jCFAPPmQy1CrxQqD9RSaSz+8O5feMW:kPrPw0ycbR7Aty18xQqpx8O5fz

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe

description	pid	process	target process
PID 1696 wrote to memory of 988	1696	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe
PID 1696 wrote to memory of 988	1696	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe
PID 1696 wrote to memory of 988	1696	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe
PID 1696 wrote to memory of 988	1696	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe
PID 1696 wrote to memory of 988	1696	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe
PID 1696 wrote to memory of 988	1696	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe
PID 1696 wrote to memory of 988	1696	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe
PID 1696 wrote to memory of 900	1696	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe
PID 1696 wrote to memory of 900	1696	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe
PID 1696 wrote to memory of 900	1696	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe
PID 1696 wrote to memory of 900	1696	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe
PID 1696 wrote to memory of 900	1696	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe
PID 1696 wrote to memory of 900	1696	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe
PID 1696 wrote to memory of 900	1696	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe

C:\Users\Admin\AppData\Local\Temp\2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe
"C:\Users\Admin\AppData\Local\Temp\2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1696

C:\Users\Admin\AppData\Local\Temp\2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe
start
2⤵
PID:988

C:\Users\Admin\AppData\Local\Temp\2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe
watch
2⤵
PID:900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-56-0x0000000000000000-mapping.dmp

Download
memory/900-60-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/900-63-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/900-66-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/988-57-0x0000000000000000-mapping.dmp

Download
memory/988-59-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/988-64-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/988-65-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1696-54-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1696-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/1696-58-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download