c26b4cc9630e6369e2638d48f32f0712adde5f7f0b2c83049fbc5be0c42b88a3

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fc8c6077804a3ec11fece8073cb2d172.exe
Size

193KB
MD5

fc8c6077804a3ec11fece8073cb2d172
SHA1

631a1cf9f874f08ea0e7958e6e2114a88bea5d7b
SHA256

c26b4cc9630e6369e2638d48f32f0712adde5f7f0b2c83049fbc5be0c42b88a3
SHA512

6fb95382cc05f069d6ff8337e2797551cbd8034437b21deed2d279d848def8120f4287aa6ad281850b83e38f6f326ec98baf8fe6f548a4460f6de3071317c7b9
SSDEEP

3072:tN5W11rbnMY31A+FTsW4jfl8dhnVo0sXpkbdouaJZvoT+WjPsFMZK:n5W11n9Ps9+VoU6uAQT+WL+Ms

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1840	fc8c6077804a3ec11fece8073cb2d172.exe
1840	fc8c6077804a3ec11fece8073cb2d172.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 1392	1840	fc8c6077804a3ec11fece8073cb2d172.exe	6
PID 1840 wrote to memory of 1392	1840	fc8c6077804a3ec11fece8073cb2d172.exe	6
PID 1840 wrote to memory of 1392	1840	fc8c6077804a3ec11fece8073cb2d172.exe	6
PID 1840 wrote to memory of 1392	1840	fc8c6077804a3ec11fece8073cb2d172.exe	6

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1392
- C:\Users\Admin\AppData\Local\Temp\fc8c6077804a3ec11fece8073cb2d172.exe
  "C:\Users\Admin\AppData\Local\Temp\fc8c6077804a3ec11fece8073cb2d172.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1392-14-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1392-19-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1840-3-0x0000000000240000-0x0000000000250000-memory.dmp

Filesize
64KB

Download
memory/1840-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1840-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1840-2-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1840-1-0x0000000000220000-0x0000000000224000-memory.dmp

Filesize
16KB

Download
memory/1840-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1840-8-0x00000000756E0000-0x00000000757F0000-memory.dmp

Filesize
1.1MB

Download
memory/1840-9-0x0000000001F30000-0x0000000001F40000-memory.dmp

Filesize
64KB

Download
memory/1840-10-0x0000000000310000-0x0000000000349000-memory.dmp

Filesize
228KB

Download
memory/1840-7-0x0000000076FCF000-0x0000000076FD0000-memory.dmp

Filesize
4KB

Download
memory/1840-12-0x0000000000360000-0x0000000000362000-memory.dmp

Filesize
8KB

Download
memory/1840-18-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1840-17-0x0000000076FD1000-0x0000000076FD2000-memory.dmp

Filesize
4KB

Download
memory/1840-5-0x00000000003A0000-0x00000000003B0000-memory.dmp

Filesize
64KB

Download
memory/1840-6-0x0000000076FD0000-0x0000000076FD1000-memory.dmp

Filesize
4KB

Download
memory/1840-28-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1840-30-0x00000000756E0000-0x00000000757F0000-memory.dmp

Filesize
1.1MB

Download
memory/1840-29-0x0000000000310000-0x0000000000349000-memory.dmp

Filesize
228KB

Download