Analysis
- max time kernel
45s - max time network
153s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
12/12/2022, 16:50
General
- Target 3142b9d2704771ae6a3273ef5967fc3e.exe
- Size 1.1MB
- Sample221212-vb858aef5v
- SHA256 82d8c107a3489fc8f149fde6469c51309a14fcd816d33d0a709af4b5ffc44ed4
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 2 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3142b9d2704771ae6a3273ef5967fc3e.exe"C:\Users\Admin\AppData\Local\Temp\3142b9d2704771ae6a3273ef5967fc3e.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Uyieweaiht.tmp",Hfesyte2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
Uyieweaiht.tmp
Uyieweaiht.tmp
memory/1896-54-0x00000000005A0000-0x0000000000688000-memory.dmp
memory/1896-55-0x0000000076181000-0x0000000076183000-memory.dmp
memory/1896-57-0x00000000005A0000-0x0000000000688000-memory.dmp
memory/1896-59-0x0000000001EB0000-0x0000000001FD9000-memory.dmp
memory/1896-60-0x0000000000400000-0x0000000000532000-memory.dmp