Analysis

  • max time kernel
    56s
  • max time network
    227s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2022, 14:27

General

  • Target

    cb6946cee30f816cb70e76a585fda5c644b05f65a2c1f324a16e8c689b32872d.exe

  • Size

    28KB

  • MD5

    50776a5a0891fbab252eb19934e1821b

  • SHA1

    3251ee6328b80e42fcee3b7e427961a65fdd3909

  • SHA256

    cb6946cee30f816cb70e76a585fda5c644b05f65a2c1f324a16e8c689b32872d

  • SHA512

    076a109f405694cc7bbb3f7888a41eb0c1eeda0f62aba411ae44ee1b77553eff9d2e3bfbc8bb76ee2ada5df7af7b12fad7e2cf3217475a4ae972a46abcf13174

  • SSDEEP

    384:UmOyMLjKMPH1Dxw7ZA8l9ZoA7k+w9G5hmssR0IkR46nzojn8mgRRtssIeo/r5J1P:hUjKVjl9xw3x6nz7vj1wrJ

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1208
      • C:\Users\Admin\AppData\Local\Temp\cb6946cee30f816cb70e76a585fda5c644b05f65a2c1f324a16e8c689b32872d.exe
        "C:\Users\Admin\AppData\Local\Temp\cb6946cee30f816cb70e76a585fda5c644b05f65a2c1f324a16e8c689b32872d.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:604

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/604-54-0x0000000076411000-0x0000000076413000-memory.dmp

      Filesize

      8KB

    • memory/604-55-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/604-56-0x0000000010000000-0x0000000010011000-memory.dmp

      Filesize

      68KB

    • memory/604-60-0x0000000010000000-0x0000000010011000-memory.dmp

      Filesize

      68KB

    • memory/1208-57-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

      Filesize

      24KB