Analysis
-
max time kernel
41s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 07:48
Static task
static1
Behavioral task
behavioral1
Sample
36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe
Resource
win10v2004-20221111-en
General
-
Target
36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe
-
Size
522KB
-
MD5
53dc82ee06f8a6a956fbda62c85b0160
-
SHA1
e4782c0b21a27bd1053f6337e04759e585ddae8b
-
SHA256
36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c
-
SHA512
8c72d2d9d37fbd0f344fdf1f6d82afabbf25934a22ab63faa359b886af3378043268615446b775e67256cf8c73dd4afbd5f1f9bc858e431eea9c9b4b4e0a9ab4
-
SSDEEP
6144:Esdmx7K4LhxnV2KSS4bu8er2JA5afDoWoJnEYeGZx+g4i4mQy1CrxQqD9RSaSz+J:n8u6kKsnS4LoUs4y18xQqpx8O5TM
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exedescription pid process target process PID 1208 wrote to memory of 896 1208 36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe 36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe PID 1208 wrote to memory of 896 1208 36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe 36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe PID 1208 wrote to memory of 896 1208 36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe 36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe PID 1208 wrote to memory of 896 1208 36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe 36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe PID 1208 wrote to memory of 896 1208 36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe 36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe PID 1208 wrote to memory of 896 1208 36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe 36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe PID 1208 wrote to memory of 896 1208 36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe 36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe PID 1208 wrote to memory of 884 1208 36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe 36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe PID 1208 wrote to memory of 884 1208 36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe 36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe PID 1208 wrote to memory of 884 1208 36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe 36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe PID 1208 wrote to memory of 884 1208 36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe 36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe PID 1208 wrote to memory of 884 1208 36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe 36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe PID 1208 wrote to memory of 884 1208 36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe 36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe PID 1208 wrote to memory of 884 1208 36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe 36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe"C:\Users\Admin\AppData\Local\Temp\36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exestart2⤵
-
C:\Users\Admin\AppData\Local\Temp\36c7665165a2c0d5b704cdf53489ae67f68a5b891e017e4ee1f04d0fa40fe65c.exewatch2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/884-56-0x0000000000000000-mapping.dmp
-
memory/884-60-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/884-64-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/884-66-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/896-57-0x0000000000000000-mapping.dmp
-
memory/896-59-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/896-63-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/896-65-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1208-54-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1208-55-0x0000000075D01000-0x0000000075D03000-memory.dmpFilesize
8KB
-
memory/1208-58-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB