Analysis
-
max time kernel
164s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 14:35
Static task
static1
Behavioral task
behavioral1
Sample
37b506ae806639497ce8fad34a08dbe4e826013b9d91117f85b122a458841541.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
37b506ae806639497ce8fad34a08dbe4e826013b9d91117f85b122a458841541.exe
Resource
win10v2004-20220812-en
General
-
Target
37b506ae806639497ce8fad34a08dbe4e826013b9d91117f85b122a458841541.exe
-
Size
522KB
-
MD5
3f864dcddff2c87c0722190b67c3cefc
-
SHA1
a648b7292a491a7d97d72af2b7187735fcde0390
-
SHA256
37b506ae806639497ce8fad34a08dbe4e826013b9d91117f85b122a458841541
-
SHA512
9be46ec5087c81868814f290e3461d721b7807ab554d40f07cbdbd2efc8de905bb5c2dbc6179658dd2431829977ad6f5b76e5074077cf74d6745017addfec6a0
-
SSDEEP
12288:0RL+YCmZ9nMMhy9BkQfLcMy18xQqpx8O5gV:0RRzd8FDcMatqpx8
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
37b506ae806639497ce8fad34a08dbe4e826013b9d91117f85b122a458841541.exedescription pid process target process PID 2008 wrote to memory of 5032 2008 37b506ae806639497ce8fad34a08dbe4e826013b9d91117f85b122a458841541.exe 37b506ae806639497ce8fad34a08dbe4e826013b9d91117f85b122a458841541.exe PID 2008 wrote to memory of 5032 2008 37b506ae806639497ce8fad34a08dbe4e826013b9d91117f85b122a458841541.exe 37b506ae806639497ce8fad34a08dbe4e826013b9d91117f85b122a458841541.exe PID 2008 wrote to memory of 5032 2008 37b506ae806639497ce8fad34a08dbe4e826013b9d91117f85b122a458841541.exe 37b506ae806639497ce8fad34a08dbe4e826013b9d91117f85b122a458841541.exe PID 2008 wrote to memory of 384 2008 37b506ae806639497ce8fad34a08dbe4e826013b9d91117f85b122a458841541.exe 37b506ae806639497ce8fad34a08dbe4e826013b9d91117f85b122a458841541.exe PID 2008 wrote to memory of 384 2008 37b506ae806639497ce8fad34a08dbe4e826013b9d91117f85b122a458841541.exe 37b506ae806639497ce8fad34a08dbe4e826013b9d91117f85b122a458841541.exe PID 2008 wrote to memory of 384 2008 37b506ae806639497ce8fad34a08dbe4e826013b9d91117f85b122a458841541.exe 37b506ae806639497ce8fad34a08dbe4e826013b9d91117f85b122a458841541.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\37b506ae806639497ce8fad34a08dbe4e826013b9d91117f85b122a458841541.exe"C:\Users\Admin\AppData\Local\Temp\37b506ae806639497ce8fad34a08dbe4e826013b9d91117f85b122a458841541.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\37b506ae806639497ce8fad34a08dbe4e826013b9d91117f85b122a458841541.exestart2⤵
-
C:\Users\Admin\AppData\Local\Temp\37b506ae806639497ce8fad34a08dbe4e826013b9d91117f85b122a458841541.exewatch2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/384-133-0x0000000000000000-mapping.dmp
-
memory/384-136-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/384-138-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/384-141-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2008-132-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2008-135-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/5032-134-0x0000000000000000-mapping.dmp
-
memory/5032-137-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/5032-139-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/5032-140-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB