Analysis
-
max time kernel
183s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 14:36
Static task
static1
Behavioral task
behavioral1
Sample
364763d6efb97ef1f2c16fd0fe345e7273d6349bfd903d0168a14778f7e2474c.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
364763d6efb97ef1f2c16fd0fe345e7273d6349bfd903d0168a14778f7e2474c.exe
Resource
win10v2004-20220812-en
General
-
Target
364763d6efb97ef1f2c16fd0fe345e7273d6349bfd903d0168a14778f7e2474c.exe
-
Size
524KB
-
MD5
744e67806aa6db5d3cdcfdbbc61ad96f
-
SHA1
2e2ec06e3440624f5c0d776df8040fd370b41d2f
-
SHA256
364763d6efb97ef1f2c16fd0fe345e7273d6349bfd903d0168a14778f7e2474c
-
SHA512
12db66c7deaf06901f301adaab969c1f89bfa9f7e7054ed7bebfce7e92a81a81cd75556e0309eae9e6cce75345019ea0804e7d2ff1cfb659d4a875983b7f0231
-
SSDEEP
12288:LbIDCaHuctFCeUXEc6WwiP8Kd6t1ihPqNWv4bON/uL63PTb/g0OJp/xbf+:34CaOcqeUXEOxhPqgOy/uE/QfZz+
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
364763d6efb97ef1f2c16fd0fe345e7273d6349bfd903d0168a14778f7e2474c.exedescription pid process target process PID 1972 wrote to memory of 3992 1972 364763d6efb97ef1f2c16fd0fe345e7273d6349bfd903d0168a14778f7e2474c.exe 364763d6efb97ef1f2c16fd0fe345e7273d6349bfd903d0168a14778f7e2474c.exe PID 1972 wrote to memory of 3992 1972 364763d6efb97ef1f2c16fd0fe345e7273d6349bfd903d0168a14778f7e2474c.exe 364763d6efb97ef1f2c16fd0fe345e7273d6349bfd903d0168a14778f7e2474c.exe PID 1972 wrote to memory of 3992 1972 364763d6efb97ef1f2c16fd0fe345e7273d6349bfd903d0168a14778f7e2474c.exe 364763d6efb97ef1f2c16fd0fe345e7273d6349bfd903d0168a14778f7e2474c.exe PID 1972 wrote to memory of 632 1972 364763d6efb97ef1f2c16fd0fe345e7273d6349bfd903d0168a14778f7e2474c.exe 364763d6efb97ef1f2c16fd0fe345e7273d6349bfd903d0168a14778f7e2474c.exe PID 1972 wrote to memory of 632 1972 364763d6efb97ef1f2c16fd0fe345e7273d6349bfd903d0168a14778f7e2474c.exe 364763d6efb97ef1f2c16fd0fe345e7273d6349bfd903d0168a14778f7e2474c.exe PID 1972 wrote to memory of 632 1972 364763d6efb97ef1f2c16fd0fe345e7273d6349bfd903d0168a14778f7e2474c.exe 364763d6efb97ef1f2c16fd0fe345e7273d6349bfd903d0168a14778f7e2474c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\364763d6efb97ef1f2c16fd0fe345e7273d6349bfd903d0168a14778f7e2474c.exe"C:\Users\Admin\AppData\Local\Temp\364763d6efb97ef1f2c16fd0fe345e7273d6349bfd903d0168a14778f7e2474c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\364763d6efb97ef1f2c16fd0fe345e7273d6349bfd903d0168a14778f7e2474c.exestart2⤵
-
C:\Users\Admin\AppData\Local\Temp\364763d6efb97ef1f2c16fd0fe345e7273d6349bfd903d0168a14778f7e2474c.exewatch2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/632-132-0x0000000000000000-mapping.dmp
-
memory/632-136-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/632-138-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1972-134-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/3992-133-0x0000000000000000-mapping.dmp
-
memory/3992-135-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/3992-137-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB