66350ca1493dc0d264215966c9ae5f192a7c08459c47b8e7c2ee022226e80a91 | Triage

Analysis

max time kernel
117s
max time network
131s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 03:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Excel.exe
Size

1.8MB
MD5

0fc6b2aa77bb9afddb46db42e3ca7069
SHA1

906a86710f77b84c8984b777a05497f523369218
SHA256

66350ca1493dc0d264215966c9ae5f192a7c08459c47b8e7c2ee022226e80a91
SHA512

23553bc81aed61cdd15e90cf8adf704d83464699876b9d1244badeac2be5cde054ad19a0537b5c56308634c859d78b5284d9f4abefe95d41baadbeb99a996069
SSDEEP

24576:3WbJKHfISI0dEwVnsb5KjvqTYe5kVeaQh2YvK5gEYelC:0AHAPXwRjvXG9h2YQC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1688	1668	Excel.exe	29
PID 1668 wrote to memory of 1688	1668	Excel.exe	29
PID 1668 wrote to memory of 1688	1668	Excel.exe	29

C:\Users\Admin\AppData\Local\Temp\Excel.exe
"C:\Users\Admin\AppData\Local\Temp\Excel.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:1688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1668-0-0x0000000047D50000-0x0000000047D51000-memory.dmp

Filesize
4KB

Download