96ef205b273f3f89847c788c9b63797a5fcf899c4b25106f7a21ab57311e4c2a | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 12:32

Sharing

Report Analysis Logs

General

Target

1ea32dddabc7401fa9f12e5f4c01c209.exe
Size

399KB
MD5

1ea32dddabc7401fa9f12e5f4c01c209
SHA1

f69624baab8c14252db2acc17d6f83ba111e6d72
SHA256

96ef205b273f3f89847c788c9b63797a5fcf899c4b25106f7a21ab57311e4c2a
SHA512

6f88a3c69987371179c92f3a4e532468b466c133ff465569de9308c5e7ae45c3a2a1e9efe7acbe72c9e0088e036032cb30a1e412e7c9f0b2750e007165edf544
SSDEEP

12288:0Z4SZt7Ru5igkb6Beigj+YGpvLrY9c3UbzeP6:dEttu5igk+BMiYGpPNUN

Score

1^/10

Malware Config

Signatures

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

1ea32dddabc7401fa9f12e5f4c01c209.exe

pid process

1144 1ea32dddabc7401fa9f12e5f4c01c209.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1ea32dddabc7401fa9f12e5f4c01c209.exe

description	pid	process	target process
PID 1144 wrote to memory of 840	1144	1ea32dddabc7401fa9f12e5f4c01c209.exe	1ea32dddabc7401fa9f12e5f4c01c209.exe
PID 1144 wrote to memory of 840	1144	1ea32dddabc7401fa9f12e5f4c01c209.exe	1ea32dddabc7401fa9f12e5f4c01c209.exe
PID 1144 wrote to memory of 840	1144	1ea32dddabc7401fa9f12e5f4c01c209.exe	1ea32dddabc7401fa9f12e5f4c01c209.exe
PID 1144 wrote to memory of 840	1144	1ea32dddabc7401fa9f12e5f4c01c209.exe	1ea32dddabc7401fa9f12e5f4c01c209.exe

C:\Users\Admin\AppData\Local\Temp\1ea32dddabc7401fa9f12e5f4c01c209.exe
"C:\Users\Admin\AppData\Local\Temp\1ea32dddabc7401fa9f12e5f4c01c209.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Users\Admin\AppData\Local\Temp\1ea32dddabc7401fa9f12e5f4c01c209.exe
  "C:\Users\Admin\AppData\Local\Temp\1ea32dddabc7401fa9f12e5f4c01c209.exe"
  2⤵
  PID:840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1144-0-0x0000000000FB0000-0x0000000000FE5000-memory.dmp

Filesize
212KB

Download
memory/1144-1-0x0000000000130000-0x0000000000132000-memory.dmp

Filesize
8KB

Download