Analysis

  • max time kernel
    179s
  • max time network
    204s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2022, 10:03

General

  • Target

    shvatka_so_lyavami_tfile_ru_avi.exe

  • Size

    525KB

  • MD5

    278ca39be5650ad7649491ce06669830

  • SHA1

    373b5f4c72c2d5887e2f9b5bc9bca44217e9fec8

  • SHA256

    4b73a5ca2120cb52424d21573fc1ffe4086f8a194f3b859fc43902353d8ca42e

  • SHA512

    00f7b5734199fb571057d47da31d657ca4b50959fa0ee2b33773eba99c817df8a71d0937460f830864676051268f7a29be1989076a923d1b47247a1d79c1bef6

  • SSDEEP

    6144:o2Zt0ApuG+jBxZJcN5CRHR8R37W9aFCi9PPkBBshijhNPO8S/B9Y6BI0EUIP6na3:o2Zt0AcrJwyRqEAxRkb4P6l0Q

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\shvatka_so_lyavami_tfile_ru_avi.exe
    "C:\Users\Admin\AppData\Local\Temp\shvatka_so_lyavami_tfile_ru_avi.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4972
    • C:\Users\Admin\AppData\Local\Temp\shvatka_so_lyavami_tfile_ru_avi.exe
      start
      2⤵
        PID:2140
      • C:\Users\Admin\AppData\Local\Temp\shvatka_so_lyavami_tfile_ru_avi.exe
        watch
        2⤵
          PID:2272

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2140-135-0x0000000000400000-0x000000000048A000-memory.dmp

        Filesize

        552KB

      • memory/2140-137-0x0000000000400000-0x000000000048A000-memory.dmp

        Filesize

        552KB

      • memory/2140-138-0x0000000000400000-0x000000000048A000-memory.dmp

        Filesize

        552KB

      • memory/2272-136-0x0000000000400000-0x000000000048A000-memory.dmp

        Filesize

        552KB

      • memory/2272-139-0x0000000000400000-0x000000000048A000-memory.dmp

        Filesize

        552KB

      • memory/4972-134-0x0000000000400000-0x000000000048A000-memory.dmp

        Filesize

        552KB