bd2b126d573abdf7a1f05e469fa513e974ac9df22de34beb9c00345259ffe29c | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 20:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f6ecb987ea8f4d36c248711070cd1208.exe
Size

36KB
MD5

f6ecb987ea8f4d36c248711070cd1208
SHA1

3c2b96308ffa33c5705df9e2ea0601c7a1bd7dc7
SHA256

bd2b126d573abdf7a1f05e469fa513e974ac9df22de34beb9c00345259ffe29c
SHA512

522e73459155bfea8edb5dccff5c416db9362f5e16cb4b9aea79f1fc436eef47a0dc529c245de53ec91730cf811187bda4280a543cd55e05138fed85bdcde408
SSDEEP

384:cHP1qaBKxCd7PpLjzKb29lKDYyKsez8/tK:cHPdBKYXx48zso8/tK

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 2648	1360	f6ecb987ea8f4d36c248711070cd1208.exe	14
PID 1360 wrote to memory of 2648	1360	f6ecb987ea8f4d36c248711070cd1208.exe	14
PID 1360 wrote to memory of 2648	1360	f6ecb987ea8f4d36c248711070cd1208.exe	14
PID 1360 wrote to memory of 2648	1360	f6ecb987ea8f4d36c248711070cd1208.exe	14
PID 1360 wrote to memory of 2648	1360	f6ecb987ea8f4d36c248711070cd1208.exe	14
PID 1360 wrote to memory of 2648	1360	f6ecb987ea8f4d36c248711070cd1208.exe	14
PID 1360 wrote to memory of 2648	1360	f6ecb987ea8f4d36c248711070cd1208.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\WINDOWS\system32\wefcvysewb.sd,mymain
1⤵
PID:2648

C:\Users\Admin\AppData\Local\Temp\f6ecb987ea8f4d36c248711070cd1208.exe
"C:\Users\Admin\AppData\Local\Temp\f6ecb987ea8f4d36c248711070cd1208.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads