cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b

General

Target

cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe
Size

22KB
MD5

d87d3c4c15bb1a1cdae175b030faa995
SHA1

f601a0dcee3be3d1509bb1b20f623b383612ff8c
SHA256

cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b
SHA512

b6c864ad3404e19bf9377f2077b956c5052d64b971b850e47603b499da1bdf821d92b5afab295a73f9c9384e9889367b717ae3e67a3c151d12eef08a02b0003d
SSDEEP

384:LFsk7e5SWjzuwwq7r0nrixboX8jC29Mq+LG5H:xsDHw4rYabHjCAjH

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe

pid process

812 cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe

pid	process
812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe

description	pid	process	target process
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE
PID 812 wrote to memory of 1300	812	cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1300

C:\Users\Admin\AppData\Local\Temp\cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe
"C:\Users\Admin\AppData\Local\Temp\cb3dca2e081091aff8219da1bbc465839a666b4e527daa57e3cfc2bdbf663d2b.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/812-54-0x0000000075131000-0x0000000075133000-memory.dmp

Filesize
8KB

Download
memory/812-55-0x00000000002C0000-0x00000000002C4000-memory.dmp

Filesize
16KB

Download
memory/812-56-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads