084d376d323c8eb5d77a446295a94f236bb93945a4df6cdd5b96ba517584963e

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/01/2023, 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42a7f93250c5512797946e177cbaf44dfbed5d58.exe
Size

856KB
MD5

beeb5de149b4c472848421bee7416093
SHA1

42a7f93250c5512797946e177cbaf44dfbed5d58
SHA256

084d376d323c8eb5d77a446295a94f236bb93945a4df6cdd5b96ba517584963e
SHA512

22d165f268fca102ce2197e73d657f30d3e96eb5eaa3e7daf3cf6aeec4dbfeab9ed1be4a4a791fc386dcd8198dfb60c81aa6eb1a4679978ed1c738dc1b037153
SSDEEP

3072:ivS07xLCZ3IhEq6OdmpBf65NvDaNN5CEddUHzNJNMsnSJ9NJCHwFwkNEqWX/ODsv:ivS09LCZ3IhE5egMrXd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 956	1268	42a7f93250c5512797946e177cbaf44dfbed5d58.exe	27
PID 1268 wrote to memory of 956	1268	42a7f93250c5512797946e177cbaf44dfbed5d58.exe	27
PID 1268 wrote to memory of 956	1268	42a7f93250c5512797946e177cbaf44dfbed5d58.exe	27
PID 1268 wrote to memory of 956	1268	42a7f93250c5512797946e177cbaf44dfbed5d58.exe	27
PID 1268 wrote to memory of 1928	1268	42a7f93250c5512797946e177cbaf44dfbed5d58.exe	28
PID 1268 wrote to memory of 1928	1268	42a7f93250c5512797946e177cbaf44dfbed5d58.exe	28
PID 1268 wrote to memory of 1928	1268	42a7f93250c5512797946e177cbaf44dfbed5d58.exe	28
PID 1268 wrote to memory of 1928	1268	42a7f93250c5512797946e177cbaf44dfbed5d58.exe	28
PID 1268 wrote to memory of 964	1268	42a7f93250c5512797946e177cbaf44dfbed5d58.exe	29
PID 1268 wrote to memory of 964	1268	42a7f93250c5512797946e177cbaf44dfbed5d58.exe	29
PID 1268 wrote to memory of 964	1268	42a7f93250c5512797946e177cbaf44dfbed5d58.exe	29
PID 1268 wrote to memory of 964	1268	42a7f93250c5512797946e177cbaf44dfbed5d58.exe	29
PID 1268 wrote to memory of 940	1268	42a7f93250c5512797946e177cbaf44dfbed5d58.exe	30
PID 1268 wrote to memory of 940	1268	42a7f93250c5512797946e177cbaf44dfbed5d58.exe	30
PID 1268 wrote to memory of 940	1268	42a7f93250c5512797946e177cbaf44dfbed5d58.exe	30
PID 1268 wrote to memory of 940	1268	42a7f93250c5512797946e177cbaf44dfbed5d58.exe	30
PID 1268 wrote to memory of 1780	1268	42a7f93250c5512797946e177cbaf44dfbed5d58.exe	31
PID 1268 wrote to memory of 1780	1268	42a7f93250c5512797946e177cbaf44dfbed5d58.exe	31
PID 1268 wrote to memory of 1780	1268	42a7f93250c5512797946e177cbaf44dfbed5d58.exe	31
PID 1268 wrote to memory of 1780	1268	42a7f93250c5512797946e177cbaf44dfbed5d58.exe	31

C:\Users\Admin\AppData\Local\Temp\42a7f93250c5512797946e177cbaf44dfbed5d58.exe
"C:\Users\Admin\AppData\Local\Temp\42a7f93250c5512797946e177cbaf44dfbed5d58.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:956
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:1928
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:964
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:940
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:1780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1268-54-0x00000000011E0000-0x00000000012BA000-memory.dmp

Filesize
872KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads