67f4ae7082dc28dba6caca4a7908b0c57e63e00fa1832fba4d47c966fe0a1bd0 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 19:43

Sharing

Report Analysis Logs

General

Target

0e6df622793ffe1d6660acc9fcf4707b.exe
Size

2.3MB
MD5

0e6df622793ffe1d6660acc9fcf4707b
SHA1

7d2c11f9efc9d67168e060ec4c5107fd999b1d21
SHA256

67f4ae7082dc28dba6caca4a7908b0c57e63e00fa1832fba4d47c966fe0a1bd0
SHA512

085deaa165c8ec1ca0220b0a410487b9ad572e8e7312dd1806d46b6507fae1779f6b60acaa7e13633908c6d49a941e8a0c7e2e59225d4f864a1ea6159990d02f
SSDEEP

49152:ylY613qT7I0kQBV4sqSkfn1/dvRImNijZJr:ylELBp2T7if

Score

1^/10

Malware Config

Signatures

Runs net.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 952	1328	0e6df622793ffe1d6660acc9fcf4707b.exe	16
PID 1328 wrote to memory of 952	1328	0e6df622793ffe1d6660acc9fcf4707b.exe	16
PID 1328 wrote to memory of 952	1328	0e6df622793ffe1d6660acc9fcf4707b.exe	16
PID 1328 wrote to memory of 952	1328	0e6df622793ffe1d6660acc9fcf4707b.exe	16
PID 1328 wrote to memory of 952	1328	0e6df622793ffe1d6660acc9fcf4707b.exe	16
PID 1328 wrote to memory of 952	1328	0e6df622793ffe1d6660acc9fcf4707b.exe	16
PID 1328 wrote to memory of 952	1328	0e6df622793ffe1d6660acc9fcf4707b.exe	16
PID 952 wrote to memory of 948	952	Net.exe	17
PID 952 wrote to memory of 948	952	Net.exe	17
PID 952 wrote to memory of 948	952	Net.exe	17
PID 952 wrote to memory of 948	952	Net.exe	17
PID 952 wrote to memory of 948	952	Net.exe	17
PID 952 wrote to memory of 948	952	Net.exe	17
PID 952 wrote to memory of 948	952	Net.exe	17

C:\Windows\SysWOW64\Net.exe
Net Stop PcaSvc
1⤵
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\net1.exe
  C:\Windows\system32\net1 Stop PcaSvc
  2⤵
  PID:948

C:\Users\Admin\AppData\Local\Temp\0e6df622793ffe1d6660acc9fcf4707b.exe
"C:\Users\Admin\AppData\Local\Temp\0e6df622793ffe1d6660acc9fcf4707b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1328-2-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download