Analysis
-
max time kernel
56s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 16:32
Static task
static1
Behavioral task
behavioral1
Sample
WPE/W-P-E.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
WPE/W-P-E.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
WPE/WpASpy.dll
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
WPE/WpASpy.dll
Resource
win10v2004-20221111-en
General
-
Target
WPE/WpASpy.dll
-
Size
180KB
-
MD5
3fb67ceab8fb223312492842d7901e01
-
SHA1
24d701c846e164d8e9823237393f4bdfeef48fc1
-
SHA256
f0dc0e0813b1c63f9c6e9250558cbb1ff255ce2f077c1fc84f7f8f1efee69f62
-
SHA512
5eb565a0a8fa86770590b694380e3fa1e5f3863e959d2cfc6f089dd3b44daaf9384f2067a971806f8d9e7a9e3207e9f312cf82d33c36d4a866caacffe6d6c12d
-
SSDEEP
768:aCDlRInSTu6xpi9Hk+o4xTTWVWWwBHt3HOgiHFEkOlZCYLtfo85k2B:aLSTVOkz4xTTWKteB2kOl7lo8+2B
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1992 wrote to memory of 1972 1992 rundll32.exe rundll32.exe PID 1992 wrote to memory of 1972 1992 rundll32.exe rundll32.exe PID 1992 wrote to memory of 1972 1992 rundll32.exe rundll32.exe PID 1992 wrote to memory of 1972 1992 rundll32.exe rundll32.exe PID 1992 wrote to memory of 1972 1992 rundll32.exe rundll32.exe PID 1992 wrote to memory of 1972 1992 rundll32.exe rundll32.exe PID 1992 wrote to memory of 1972 1992 rundll32.exe rundll32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1972-54-0x0000000000000000-mapping.dmp
-
memory/1972-55-0x00000000760C1000-0x00000000760C3000-memory.dmpFilesize
8KB
-
memory/1972-56-0x0000000001E82000-0x0000000001E86000-memory.dmpFilesize
16KB
-
memory/1972-57-0x0000000001E82000-0x0000000001E86000-memory.dmpFilesize
16KB
-
memory/1972-58-0x0000000001E82000-0x0000000001E86000-memory.dmpFilesize
16KB
-
memory/1972-59-0x0000000001E82000-0x0000000001E86000-memory.dmpFilesize
16KB
-
memory/1972-60-0x0000000001E82000-0x0000000001E86000-memory.dmpFilesize
16KB
-
memory/1972-61-0x0000000001E82000-0x0000000001E86000-memory.dmpFilesize
16KB
-
memory/1972-62-0x0000000001E82000-0x0000000001E86000-memory.dmpFilesize
16KB
-
memory/1972-63-0x0000000001E82000-0x0000000001E86000-memory.dmpFilesize
16KB
-
memory/1972-64-0x0000000001E82000-0x0000000001E86000-memory.dmpFilesize
16KB
-
memory/1972-65-0x0000000001E82000-0x0000000001E86000-memory.dmpFilesize
16KB
-
memory/1972-66-0x0000000001E82000-0x0000000001E86000-memory.dmpFilesize
16KB
-
memory/1972-68-0x0000000001E82000-0x0000000001E86000-memory.dmpFilesize
16KB
-
memory/1972-69-0x0000000001E82000-0x0000000001E86000-memory.dmpFilesize
16KB
-
memory/1972-71-0x0000000001E82000-0x0000000001E86000-memory.dmpFilesize
16KB
-
memory/1972-72-0x0000000001E82000-0x0000000001E86000-memory.dmpFilesize
16KB
-
memory/1972-73-0x0000000001E82000-0x0000000001E86000-memory.dmpFilesize
16KB
-
memory/1972-70-0x0000000001E82000-0x0000000001E86000-memory.dmpFilesize
16KB
-
memory/1972-67-0x0000000001E82000-0x0000000001E86000-memory.dmpFilesize
16KB
-
memory/1972-74-0x0000000001E82000-0x0000000001E86000-memory.dmpFilesize
16KB
-
memory/1972-75-0x0000000001E82000-0x0000000001E86000-memory.dmpFilesize
16KB