cff0cb283ff627699f7fa88b29366eb1c3e5f8221752f5d195884c7b855c49f2

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 22:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f0776c61ab24e924ae4dbb54fa62d34.exe
Size

26KB
MD5

1f0776c61ab24e924ae4dbb54fa62d34
SHA1

2a5ccfc85ff95279e396294c6c915ff90ece0c54
SHA256

cff0cb283ff627699f7fa88b29366eb1c3e5f8221752f5d195884c7b855c49f2
SHA512

4366982bd05a014b6b983eaacc2dc1e5e463c0211c0082963d14f32aa9c7bf570b8392db8bdf3d103104bdcae402e13361c80f9fe0d6bfc2bb4db6acdb0c1161
SSDEEP

384:OKMMjtnMgBLKM2ES29CKnIkIQjQxc9bo6Pvjz+nIFqkQYMNMjsow1w6SHGOgPGwP:mM9+qn8QyP6DanIXImaTSmOg+wlYW

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2464	2672	1f0776c61ab24e924ae4dbb54fa62d34.exe	29
PID 2672 wrote to memory of 2464	2672	1f0776c61ab24e924ae4dbb54fa62d34.exe	29
PID 2672 wrote to memory of 2464	2672	1f0776c61ab24e924ae4dbb54fa62d34.exe	29
PID 2672 wrote to memory of 2464	2672	1f0776c61ab24e924ae4dbb54fa62d34.exe	29
PID 2672 wrote to memory of 1464	2672	1f0776c61ab24e924ae4dbb54fa62d34.exe	30
PID 2672 wrote to memory of 1464	2672	1f0776c61ab24e924ae4dbb54fa62d34.exe	30
PID 2672 wrote to memory of 1464	2672	1f0776c61ab24e924ae4dbb54fa62d34.exe	30
PID 2672 wrote to memory of 1464	2672	1f0776c61ab24e924ae4dbb54fa62d34.exe	30
PID 2672 wrote to memory of 2736	2672	1f0776c61ab24e924ae4dbb54fa62d34.exe	31
PID 2672 wrote to memory of 2736	2672	1f0776c61ab24e924ae4dbb54fa62d34.exe	31
PID 2672 wrote to memory of 2736	2672	1f0776c61ab24e924ae4dbb54fa62d34.exe	31
PID 2672 wrote to memory of 2736	2672	1f0776c61ab24e924ae4dbb54fa62d34.exe	31
PID 2672 wrote to memory of 2704	2672	1f0776c61ab24e924ae4dbb54fa62d34.exe	32
PID 2672 wrote to memory of 2704	2672	1f0776c61ab24e924ae4dbb54fa62d34.exe	32
PID 2672 wrote to memory of 2704	2672	1f0776c61ab24e924ae4dbb54fa62d34.exe	32
PID 2672 wrote to memory of 2704	2672	1f0776c61ab24e924ae4dbb54fa62d34.exe	32
PID 2672 wrote to memory of 2700	2672	1f0776c61ab24e924ae4dbb54fa62d34.exe	33
PID 2672 wrote to memory of 2700	2672	1f0776c61ab24e924ae4dbb54fa62d34.exe	33
PID 2672 wrote to memory of 2700	2672	1f0776c61ab24e924ae4dbb54fa62d34.exe	33
PID 2672 wrote to memory of 2700	2672	1f0776c61ab24e924ae4dbb54fa62d34.exe	33

C:\Users\Admin\AppData\Local\Temp\1f0776c61ab24e924ae4dbb54fa62d34.exe
"C:\Users\Admin\AppData\Local\Temp\1f0776c61ab24e924ae4dbb54fa62d34.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color A
  2⤵
  PID:2464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:1464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color C
  2⤵
  PID:2736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color D
  2⤵
  PID:2704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color E
  2⤵
  PID:2700

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads