Analysis
-
max time kernel
25s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 14:19
Static task
static1
Behavioral task
behavioral1
Sample
52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe
Resource
win10v2004-20220812-en
General
-
Target
52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe
-
Size
518KB
-
MD5
27f18ad9a3a474b01176e441911f67df
-
SHA1
e32bfcab8e48a452a819042512c31d46cd5f22c1
-
SHA256
52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1
-
SHA512
699ba5d80f47e53a673b3a9ca8cbb585e8c3c713c95e3a51a82793120510a9a78daa95b7ac2377fa2c618d0cc0a3e13e288510f82a537659f6857a82a192f181
-
SSDEEP
12288:tNU1ZvO7722M6qCeVwPUjASES/ya+WJPwTOEY/fT:r6+DMxyPuAsz+OPwTvY/
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exedescription pid process target process PID 1928 wrote to memory of 952 1928 52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe 52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe PID 1928 wrote to memory of 952 1928 52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe 52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe PID 1928 wrote to memory of 952 1928 52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe 52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe PID 1928 wrote to memory of 952 1928 52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe 52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe PID 1928 wrote to memory of 952 1928 52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe 52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe PID 1928 wrote to memory of 952 1928 52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe 52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe PID 1928 wrote to memory of 952 1928 52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe 52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe PID 1928 wrote to memory of 1520 1928 52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe 52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe PID 1928 wrote to memory of 1520 1928 52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe 52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe PID 1928 wrote to memory of 1520 1928 52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe 52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe PID 1928 wrote to memory of 1520 1928 52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe 52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe PID 1928 wrote to memory of 1520 1928 52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe 52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe PID 1928 wrote to memory of 1520 1928 52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe 52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe PID 1928 wrote to memory of 1520 1928 52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe 52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe"C:\Users\Admin\AppData\Local\Temp\52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exestart2⤵
-
C:\Users\Admin\AppData\Local\Temp\52cc30889e948e390604d6af629faff6076c7f9b4899f601d717be8b821d4ba1.exewatch2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/952-56-0x0000000000000000-mapping.dmp
-
memory/952-60-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/952-62-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1520-55-0x0000000000000000-mapping.dmp
-
memory/1520-61-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1520-63-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1928-54-0x0000000075E11000-0x0000000075E13000-memory.dmpFilesize
8KB
-
memory/1928-58-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB