fb76c1cf69ed6a07b60740fc43aed6a49f7a70bd88eeb05befacfd704962ca3d | Triage

Analysis

max time kernel
344s
max time network
402s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 17:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

3.5MB
MD5

ea73b349e5180df0bceb204a96649c58
SHA1

4a3636628c9a660d1f60afa88754a5db7f9481ec
SHA256

fb76c1cf69ed6a07b60740fc43aed6a49f7a70bd88eeb05befacfd704962ca3d
SHA512

361ff96c1cc1fae759f4ece270b915b0128da1c6a221849d407c76a5192ac2d8240a270ca1b14aa36b22c7868c564d7f096c415cb72ae65c1343686c06a8a330
SSDEEP

98304:Lr58MklK14jXr5KMkMK1Ctsr58MkMK1wKTmBHV0ufKJNAIfmHEybxVc7q:xBmI0tiu+pBHV0BApk4xV

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 4348	4768	file.exe	84
PID 4768 wrote to memory of 4348	4768	file.exe	84
PID 4768 wrote to memory of 4348	4768	file.exe	84
PID 4768 wrote to memory of 4348	4768	file.exe	84
PID 4768 wrote to memory of 4348	4768	file.exe	84
PID 4768 wrote to memory of 4348	4768	file.exe	84
PID 4768 wrote to memory of 4348	4768	file.exe	84
PID 4768 wrote to memory of 4348	4768	file.exe	84
PID 4768 wrote to memory of 4348	4768	file.exe	84

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  PID:4348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4768-132-0x0000000000F40000-0x00000000012B9000-memory.dmp

Filesize
3.5MB

Download