Analysis

  • max time kernel
    85s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 17:25

General

  • Target

    e6dbc604d49eb8f79a8056d808829d076cf114dddd203cc90b407760d8f3c90b.exe

  • Size

    164KB

  • MD5

    3a86dc89dc0c1f698d7543e7641bdbdc

  • SHA1

    d65cd81ed2749fa8548cd07c1e8b70794f24406d

  • SHA256

    e6dbc604d49eb8f79a8056d808829d076cf114dddd203cc90b407760d8f3c90b

  • SHA512

    b0a60ef88795495fef463abf04bfe29e1bd0567e31e09ea037e0b79fdf59fd5694e4058281bbf3cd94a4af808643b6fd450073a8cd029367239dcd4d669eec7c

  • SSDEEP

    3072:Uxk2qwZ4TNrhFfI+UHHGBXfd0bgMwuwHjjfOkLUROYdW1sOnuI/K4h9ZQGgJP97h:gk1NTt/vagMwuWjfOkLkOIW1x48gl9F

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1192
      • C:\Users\Admin\AppData\Local\Temp\e6dbc604d49eb8f79a8056d808829d076cf114dddd203cc90b407760d8f3c90b.exe
        "C:\Users\Admin\AppData\Local\Temp\e6dbc604d49eb8f79a8056d808829d076cf114dddd203cc90b407760d8f3c90b.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1836

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1192-63-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

            Filesize

            28KB

          • memory/1836-57-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1836-56-0x0000000000290000-0x00000000002C9000-memory.dmp

            Filesize

            228KB

          • memory/1836-54-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1836-58-0x0000000001F41000-0x0000000001F45000-memory.dmp

            Filesize

            16KB

          • memory/1836-59-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1836-60-0x0000000075151000-0x0000000075153000-memory.dmp

            Filesize

            8KB

          • memory/1836-61-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/1836-62-0x0000000000290000-0x00000000002C9000-memory.dmp

            Filesize

            228KB

          • memory/1836-55-0x0000000000220000-0x0000000000224000-memory.dmp

            Filesize

            16KB

          • memory/1836-66-0x0000000010000000-0x0000000010013000-memory.dmp

            Filesize

            76KB

          • memory/1836-67-0x0000000001DB0000-0x0000000001EB0000-memory.dmp

            Filesize

            1024KB

          • memory/1836-68-0x0000000000290000-0x00000000002C9000-memory.dmp

            Filesize

            228KB