93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 07:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe
Size

522KB
MD5

0a7c1f6fd76890bb32224fab899dd5a2
SHA1

20173dc0a7d06f0464cd9a03eb673110200bd69e
SHA256

93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1
SHA512

f5eb187722159bf7bbff4a1016e7742464eaac121d8df0669821db0de6be3752917624df3c6840796eff8702580f24d38a881ed7511def48677324435ec22e32
SSDEEP

6144:+hTpRf3WL0qRXLqNCEtiEjpiKdCvCIUcmDS40s4xRmQy1CrxQqD9RSaSz+8O5gHd:wmL9fuvjQKpIU5GdsIjy18xQqpx8O5g

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe

description	pid	process	target process
PID 1768 wrote to memory of 1332	1768	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe
PID 1768 wrote to memory of 1332	1768	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe
PID 1768 wrote to memory of 1332	1768	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe
PID 1768 wrote to memory of 1332	1768	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe
PID 1768 wrote to memory of 1332	1768	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe
PID 1768 wrote to memory of 1332	1768	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe
PID 1768 wrote to memory of 1332	1768	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe
PID 1768 wrote to memory of 1316	1768	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe
PID 1768 wrote to memory of 1316	1768	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe
PID 1768 wrote to memory of 1316	1768	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe
PID 1768 wrote to memory of 1316	1768	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe
PID 1768 wrote to memory of 1316	1768	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe
PID 1768 wrote to memory of 1316	1768	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe
PID 1768 wrote to memory of 1316	1768	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe

C:\Users\Admin\AppData\Local\Temp\93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe
"C:\Users\Admin\AppData\Local\Temp\93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1768

C:\Users\Admin\AppData\Local\Temp\93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe
start
2⤵
PID:1332

C:\Users\Admin\AppData\Local\Temp\93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe
watch
2⤵
PID:1316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1316-56-0x0000000000000000-mapping.dmp

Download
memory/1316-60-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1316-64-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1316-66-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1332-57-0x0000000000000000-mapping.dmp

Download
memory/1332-59-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1332-62-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1332-65-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1768-54-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1768-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1768-58-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download