0ff41109cc4819d921969725f9a23947be71bfe1ed3c0e798e7987d24ee55244

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 13:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ff41109cc4819d921969725f9a23947be71bfe1ed3c0e798e7987d24ee55244.exe
Size

718KB
MD5

6db49865cc60bc1584d133405a55e679
SHA1

ac23d03fdd584246417afe995e85ed75dfc54f2a
SHA256

0ff41109cc4819d921969725f9a23947be71bfe1ed3c0e798e7987d24ee55244
SHA512

cc8da9227016c9623ca616e06a20d4a4aa550c93f0962ee1d2d0795e9410eb01ba7bb104fa308ecdf81c70aef1559aabe6689ee10fdebaaf17c8a7e3ced41623
SSDEEP

12288:7YdHz7oZV2j5W2Q6Y2BVQ428W+vqWt0S9SiPYZZz1SHU1vOjYt/8DIhd7OHYdHz:7e7QwtWeBVl2b+vhOUpkpSHU1r/eIhdn

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1720	~DFA79.tmp

Loads dropped DLL 2 IoCs

pid	Process
1728	0ff41109cc4819d921969725f9a23947be71bfe1ed3c0e798e7987d24ee55244.exe
1728	0ff41109cc4819d921969725f9a23947be71bfe1ed3c0e798e7987d24ee55244.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1720	1728	0ff41109cc4819d921969725f9a23947be71bfe1ed3c0e798e7987d24ee55244.exe	27
PID 1728 wrote to memory of 1720	1728	0ff41109cc4819d921969725f9a23947be71bfe1ed3c0e798e7987d24ee55244.exe	27
PID 1728 wrote to memory of 1720	1728	0ff41109cc4819d921969725f9a23947be71bfe1ed3c0e798e7987d24ee55244.exe	27
PID 1728 wrote to memory of 1720	1728	0ff41109cc4819d921969725f9a23947be71bfe1ed3c0e798e7987d24ee55244.exe	27

C:\Users\Admin\AppData\Local\Temp\0ff41109cc4819d921969725f9a23947be71bfe1ed3c0e798e7987d24ee55244.exe
"C:\Users\Admin\AppData\Local\Temp\0ff41109cc4819d921969725f9a23947be71bfe1ed3c0e798e7987d24ee55244.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\~DFA79.tmp
  C:\Users\Admin\AppData\Local\Temp\~DFA79.tmp OK
  2⤵
  - Executes dropped EXE
  PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~DFA79.tmp

Filesize
719KB

MD5
cce83d58a6cedc544e45fb89b6b20e6e

SHA1
0a8ca757d171154d411e3e1c540a0a22a67b69ec

SHA256
8e62840937ab7ab105d16cda9356efb7c6bbfdab3eff62f70e3916e96d2929b9

SHA512
99fa2196ad98a72669f0edc1a94fcec816a51cbc43f1a1d973e80233466d70097dc38fcbb1a506fb2817d80ecf516702791731bd681408e7ffc75dea0e619e6b

Download Submit
\Users\Admin\AppData\Local\Temp\~DFA79.tmp

Filesize
719KB

MD5
cce83d58a6cedc544e45fb89b6b20e6e

SHA1
0a8ca757d171154d411e3e1c540a0a22a67b69ec

SHA256
8e62840937ab7ab105d16cda9356efb7c6bbfdab3eff62f70e3916e96d2929b9

SHA512
99fa2196ad98a72669f0edc1a94fcec816a51cbc43f1a1d973e80233466d70097dc38fcbb1a506fb2817d80ecf516702791731bd681408e7ffc75dea0e619e6b

Download Submit
\Users\Admin\AppData\Local\Temp\~DFA79.tmp

Filesize
719KB

MD5
cce83d58a6cedc544e45fb89b6b20e6e

SHA1
0a8ca757d171154d411e3e1c540a0a22a67b69ec

SHA256
8e62840937ab7ab105d16cda9356efb7c6bbfdab3eff62f70e3916e96d2929b9

SHA512
99fa2196ad98a72669f0edc1a94fcec816a51cbc43f1a1d973e80233466d70097dc38fcbb1a506fb2817d80ecf516702791731bd681408e7ffc75dea0e619e6b

Download Submit
memory/1720-62-0x0000000000980000-0x0000000000A47000-memory.dmp

Filesize
796KB

Download
memory/1720-64-0x0000000000980000-0x0000000000A47000-memory.dmp

Filesize
796KB

Download
memory/1728-54-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1728-55-0x0000000000ED0000-0x0000000000F97000-memory.dmp

Filesize
796KB

Download
memory/1728-61-0x0000000000A40000-0x0000000000B07000-memory.dmp

Filesize
796KB

Download
memory/1728-63-0x0000000000ED0000-0x0000000000F97000-memory.dmp

Filesize
796KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads