2097a149a34a2744d20b9ce971ef1d013d09b1da6f97f4683dd51229bfc4bef0

Analysis

max time kernel
19s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

啊哈C/core/bin/--library=m.exe
Size

16KB
MD5

f93784f1055cd1d04b312e45ab9072a6
SHA1

6a2249157f6592704fd2095af4c3c9146b8e5401
SHA256

bf772c64a2a4ab415f52ae696bea0aacb1a94d125a59b4361287cd28c10dc805
SHA512

5c3ed6da41fab9ddff9cf5032de911541fd4681f8fc06db37c60f2e8a1d0b6ae6819e5010077e43f67cabd859af7a4ae55286a5eb1a0739d8f53c987bbe2dd47
SSDEEP

192:R/aHhiBQsGF3+qmuYO3ck4/kjyFSrncCD5:RkFuqmj+ck4MeMrnr9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2924	3040	--library=m.exe	14
PID 3040 wrote to memory of 2924	3040	--library=m.exe	14
PID 3040 wrote to memory of 2924	3040	--library=m.exe	14
PID 3040 wrote to memory of 2924	3040	--library=m.exe	14
PID 3040 wrote to memory of 1912	3040	--library=m.exe	30
PID 3040 wrote to memory of 1912	3040	--library=m.exe	30
PID 3040 wrote to memory of 1912	3040	--library=m.exe	30
PID 3040 wrote to memory of 1912	3040	--library=m.exe	30
PID 3040 wrote to memory of 2696	3040	--library=m.exe	31
PID 3040 wrote to memory of 2696	3040	--library=m.exe	31
PID 3040 wrote to memory of 2696	3040	--library=m.exe	31
PID 3040 wrote to memory of 2696	3040	--library=m.exe	31
PID 3040 wrote to memory of 2752	3040	--library=m.exe	32
PID 3040 wrote to memory of 2752	3040	--library=m.exe	32
PID 3040 wrote to memory of 2752	3040	--library=m.exe	32
PID 3040 wrote to memory of 2752	3040	--library=m.exe	32
PID 3040 wrote to memory of 2768	3040	--library=m.exe	33
PID 3040 wrote to memory of 2768	3040	--library=m.exe	33
PID 3040 wrote to memory of 2768	3040	--library=m.exe	33
PID 3040 wrote to memory of 2768	3040	--library=m.exe	33
PID 3040 wrote to memory of 2784	3040	--library=m.exe	34
PID 3040 wrote to memory of 2784	3040	--library=m.exe	34
PID 3040 wrote to memory of 2784	3040	--library=m.exe	34
PID 3040 wrote to memory of 2784	3040	--library=m.exe	34
PID 3040 wrote to memory of 2816	3040	--library=m.exe	35
PID 3040 wrote to memory of 2816	3040	--library=m.exe	35
PID 3040 wrote to memory of 2816	3040	--library=m.exe	35
PID 3040 wrote to memory of 2816	3040	--library=m.exe	35
PID 3040 wrote to memory of 2720	3040	--library=m.exe	36
PID 3040 wrote to memory of 2720	3040	--library=m.exe	36
PID 3040 wrote to memory of 2720	3040	--library=m.exe	36
PID 3040 wrote to memory of 2720	3040	--library=m.exe	36
PID 3040 wrote to memory of 2716	3040	--library=m.exe	37
PID 3040 wrote to memory of 2716	3040	--library=m.exe	37
PID 3040 wrote to memory of 2716	3040	--library=m.exe	37
PID 3040 wrote to memory of 2716	3040	--library=m.exe	37
PID 3040 wrote to memory of 2700	3040	--library=m.exe	38
PID 3040 wrote to memory of 2700	3040	--library=m.exe	38
PID 3040 wrote to memory of 2700	3040	--library=m.exe	38
PID 3040 wrote to memory of 2700	3040	--library=m.exe	38
PID 3040 wrote to memory of 2336	3040	--library=m.exe	39
PID 3040 wrote to memory of 2336	3040	--library=m.exe	39
PID 3040 wrote to memory of 2336	3040	--library=m.exe	39
PID 3040 wrote to memory of 2336	3040	--library=m.exe	39
PID 3040 wrote to memory of 2936	3040	--library=m.exe	40
PID 3040 wrote to memory of 2936	3040	--library=m.exe	40
PID 3040 wrote to memory of 2936	3040	--library=m.exe	40
PID 3040 wrote to memory of 2936	3040	--library=m.exe	40
PID 3040 wrote to memory of 2796	3040	--library=m.exe	41
PID 3040 wrote to memory of 2796	3040	--library=m.exe	41
PID 3040 wrote to memory of 2796	3040	--library=m.exe	41
PID 3040 wrote to memory of 2796	3040	--library=m.exe	41
PID 3040 wrote to memory of 2808	3040	--library=m.exe	42
PID 3040 wrote to memory of 2808	3040	--library=m.exe	42
PID 3040 wrote to memory of 2808	3040	--library=m.exe	42
PID 3040 wrote to memory of 2808	3040	--library=m.exe	42
PID 3040 wrote to memory of 2900	3040	--library=m.exe	43
PID 3040 wrote to memory of 2900	3040	--library=m.exe	43
PID 3040 wrote to memory of 2900	3040	--library=m.exe	43
PID 3040 wrote to memory of 2900	3040	--library=m.exe	43
PID 3040 wrote to memory of 2668	3040	--library=m.exe	44
PID 3040 wrote to memory of 2668	3040	--library=m.exe	44
PID 3040 wrote to memory of 2668	3040	--library=m.exe	44
PID 3040 wrote to memory of 2668	3040	--library=m.exe	44

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c color 13
1⤵
PID:2924

C:\Users\Admin\AppData\Local\Temp\啊哈C\core\bin\--library=m.exe
"C:\Users\Admin\AppData\Local\Temp\啊哈C\core\bin\--library=m.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2808
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2780
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:1416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3040-0-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads