38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b

Analysis

max time kernel
42s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe
Size

521KB
MD5

94ebaaf9cb2a4ae36bb96ab0ad44b83f
SHA1

5051241478227862b3050b9daf8e1abd2149006d
SHA256

38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b
SHA512

87bf48fbcfc7903dfdb0715343b87df50c6dd7e83758a93e2ea4ee9b68e3fca041809553a4b7848aa8d786c916c87846dff9c0de368f4cf359eeb036770e824d
SSDEEP

6144:hB/x0XOUaT/wc4XTx6WpLVvOxXrOM524gwfo+JXJF6v3Sg8Gf8yRtD3iBeJQG2X7:hP0uwpsxXrO2lJZdGexGWRLUR9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe

description	pid	process	target process
PID 1396 wrote to memory of 1628	1396	38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe	38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe
PID 1396 wrote to memory of 1628	1396	38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe	38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe
PID 1396 wrote to memory of 1628	1396	38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe	38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe
PID 1396 wrote to memory of 1628	1396	38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe	38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe
PID 1396 wrote to memory of 1628	1396	38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe	38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe
PID 1396 wrote to memory of 1628	1396	38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe	38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe
PID 1396 wrote to memory of 1628	1396	38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe	38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe
PID 1396 wrote to memory of 904	1396	38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe	38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe
PID 1396 wrote to memory of 904	1396	38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe	38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe
PID 1396 wrote to memory of 904	1396	38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe	38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe
PID 1396 wrote to memory of 904	1396	38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe	38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe
PID 1396 wrote to memory of 904	1396	38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe	38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe
PID 1396 wrote to memory of 904	1396	38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe	38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe
PID 1396 wrote to memory of 904	1396	38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe	38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe

C:\Users\Admin\AppData\Local\Temp\38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe
"C:\Users\Admin\AppData\Local\Temp\38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1396

C:\Users\Admin\AppData\Local\Temp\38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe
start
2⤵
PID:1628

C:\Users\Admin\AppData\Local\Temp\38c28d4f9691777f6cc266acd04e3d2e75bf989d1cc58594a2136ad18bf3304b.exe
watch
2⤵
PID:904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/904-55-0x0000000000000000-mapping.dmp

Download
memory/904-60-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/904-63-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1396-54-0x00000000760E1000-0x00000000760E3000-memory.dmp

Filesize
8KB

Download
memory/1396-57-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1628-56-0x0000000000000000-mapping.dmp

Download
memory/1628-61-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1628-62-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download