Analysis
-
max time kernel
34s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 14:21
Static task
static1
Behavioral task
behavioral1
Sample
4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe
Resource
win10v2004-20220812-en
General
-
Target
4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe
-
Size
522KB
-
MD5
16496eb948b1729251e1f321578bfb10
-
SHA1
2846f8d7aab261895fdfd82881a89efc1e326509
-
SHA256
4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8
-
SHA512
06460e20cf795acea76bd31f04cbc8abac907cc2f904c726890b0cbdd039a32fdfbb7136fb9b6e428e28d61972a5fda99592d9b81653fb1edf51cd2cb2988b92
-
SSDEEP
12288:pInLr/l2qHLxl/o3F7cfitoy18xQqpx8O5j:kvdXtCVcfIoatqpx8
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exedescription pid process target process PID 900 wrote to memory of 940 900 4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe 4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe PID 900 wrote to memory of 940 900 4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe 4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe PID 900 wrote to memory of 940 900 4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe 4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe PID 900 wrote to memory of 940 900 4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe 4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe PID 900 wrote to memory of 940 900 4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe 4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe PID 900 wrote to memory of 940 900 4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe 4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe PID 900 wrote to memory of 940 900 4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe 4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe PID 900 wrote to memory of 1992 900 4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe 4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe PID 900 wrote to memory of 1992 900 4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe 4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe PID 900 wrote to memory of 1992 900 4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe 4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe PID 900 wrote to memory of 1992 900 4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe 4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe PID 900 wrote to memory of 1992 900 4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe 4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe PID 900 wrote to memory of 1992 900 4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe 4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe PID 900 wrote to memory of 1992 900 4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe 4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe"C:\Users\Admin\AppData\Local\Temp\4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exestart2⤵
-
C:\Users\Admin\AppData\Local\Temp\4dfd5cac7f4f5082cc893eb143a13483cb51bc4f707b2525b034c7ab95ab13c8.exewatch2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/900-58-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/900-55-0x0000000076071000-0x0000000076073000-memory.dmpFilesize
8KB
-
memory/900-54-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/940-60-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/940-57-0x0000000000000000-mapping.dmp
-
memory/940-64-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/940-66-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/940-67-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1992-59-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1992-56-0x0000000000000000-mapping.dmp
-
memory/1992-63-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1992-65-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1992-68-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB