Analysis
-
max time kernel
161s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 07:43
Static task
static1
Behavioral task
behavioral1
Sample
766959f204143450e276d866ec261748d81b95055cbcd6c43a93081cd7382c72.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
766959f204143450e276d866ec261748d81b95055cbcd6c43a93081cd7382c72.exe
Resource
win10v2004-20221111-en
General
-
Target
766959f204143450e276d866ec261748d81b95055cbcd6c43a93081cd7382c72.exe
-
Size
547KB
-
MD5
885cf19f81a0e6306cd600673cf63325
-
SHA1
1fee9d3806bf038b749b79990c2ecd40056407c2
-
SHA256
766959f204143450e276d866ec261748d81b95055cbcd6c43a93081cd7382c72
-
SHA512
d1076df17457c8039c2fa4126da5b60d4aae7ed75ccf4af7ffa84a34ee021be8ac8d935297e565449760f1158dc56229836ef87d07153b6768ae8c17c335055d
-
SSDEEP
12288:RUn1b5/MVcRTVfCJ5e9/DBSI6HeB5895YMdhwJ8dW58tjRn:Kn95kVcNJswBEHe0nYMdhwGdWY
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
766959f204143450e276d866ec261748d81b95055cbcd6c43a93081cd7382c72.exedescription pid process target process PID 4640 wrote to memory of 4928 4640 766959f204143450e276d866ec261748d81b95055cbcd6c43a93081cd7382c72.exe 766959f204143450e276d866ec261748d81b95055cbcd6c43a93081cd7382c72.exe PID 4640 wrote to memory of 4928 4640 766959f204143450e276d866ec261748d81b95055cbcd6c43a93081cd7382c72.exe 766959f204143450e276d866ec261748d81b95055cbcd6c43a93081cd7382c72.exe PID 4640 wrote to memory of 4928 4640 766959f204143450e276d866ec261748d81b95055cbcd6c43a93081cd7382c72.exe 766959f204143450e276d866ec261748d81b95055cbcd6c43a93081cd7382c72.exe PID 4640 wrote to memory of 1872 4640 766959f204143450e276d866ec261748d81b95055cbcd6c43a93081cd7382c72.exe 766959f204143450e276d866ec261748d81b95055cbcd6c43a93081cd7382c72.exe PID 4640 wrote to memory of 1872 4640 766959f204143450e276d866ec261748d81b95055cbcd6c43a93081cd7382c72.exe 766959f204143450e276d866ec261748d81b95055cbcd6c43a93081cd7382c72.exe PID 4640 wrote to memory of 1872 4640 766959f204143450e276d866ec261748d81b95055cbcd6c43a93081cd7382c72.exe 766959f204143450e276d866ec261748d81b95055cbcd6c43a93081cd7382c72.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\766959f204143450e276d866ec261748d81b95055cbcd6c43a93081cd7382c72.exe"C:\Users\Admin\AppData\Local\Temp\766959f204143450e276d866ec261748d81b95055cbcd6c43a93081cd7382c72.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\766959f204143450e276d866ec261748d81b95055cbcd6c43a93081cd7382c72.exestart2⤵
-
C:\Users\Admin\AppData\Local\Temp\766959f204143450e276d866ec261748d81b95055cbcd6c43a93081cd7382c72.exewatch2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1872-133-0x0000000000000000-mapping.dmp
-
memory/1872-136-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/1872-138-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/4640-134-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/4928-132-0x0000000000000000-mapping.dmp
-
memory/4928-135-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/4928-137-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB