Analysis

  • max time kernel
    41s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2022, 14:25

General

  • Target

    80096a8c677b0299fd3247455bf8a85f0a1be3a8cae8e9e697df68276f26afaa.exe

  • Size

    176KB

  • MD5

    1da6ed22df32c14d4ead9b8c54a9480a

  • SHA1

    ed52fe41e18fbf249903eec4403bc0852043381d

  • SHA256

    80096a8c677b0299fd3247455bf8a85f0a1be3a8cae8e9e697df68276f26afaa

  • SHA512

    db339c1299c6d5a883fbe508b828e71b04c960ce7494f0e79ff30da344d3b270852401860e3ae5d927c499442ff9070a656e26c1b8156769eb2e41a3f134b1ef

  • SSDEEP

    3072:d2bnu8pFCYLZIshN4bStQfKIcbtwPQvSJPIPmUDHoPl+ZKwnI/CJ:dPQCY5hN4bDfMbtvsz22cK0FJ

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1212
      • C:\Users\Admin\AppData\Local\Temp\80096a8c677b0299fd3247455bf8a85f0a1be3a8cae8e9e697df68276f26afaa.exe
        "C:\Users\Admin\AppData\Local\Temp\80096a8c677b0299fd3247455bf8a85f0a1be3a8cae8e9e697df68276f26afaa.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1688

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1212-61-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

            Filesize

            28KB

          • memory/1688-54-0x0000000000400000-0x000000000042C000-memory.dmp

            Filesize

            176KB

          • memory/1688-55-0x0000000000220000-0x0000000000224000-memory.dmp

            Filesize

            16KB

          • memory/1688-56-0x0000000000330000-0x0000000000369000-memory.dmp

            Filesize

            228KB

          • memory/1688-57-0x0000000000400000-0x000000000042C000-memory.dmp

            Filesize

            176KB

          • memory/1688-58-0x0000000000400000-0x000000000042C000-memory.dmp

            Filesize

            176KB

          • memory/1688-59-0x00000000003C1000-0x00000000003C5000-memory.dmp

            Filesize

            16KB

          • memory/1688-60-0x0000000075601000-0x0000000075603000-memory.dmp

            Filesize

            8KB

          • memory/1688-64-0x0000000010000000-0x0000000010013000-memory.dmp

            Filesize

            76KB

          • memory/1688-65-0x0000000001DD0000-0x0000000001ED0000-memory.dmp

            Filesize

            1024KB

          • memory/1688-66-0x0000000000330000-0x0000000000369000-memory.dmp

            Filesize

            228KB