ce784d1c093f7543584ef86e0973e4b046c87eb5a40619c9f72941007faa8959 | Triage

Analysis

max time kernel
142s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 11:11

Sharing

Report Analysis Logs

General

Target

16d7c031c57e093eb2576ed780e90ffc.exe
Size

64KB
MD5

16d7c031c57e093eb2576ed780e90ffc
SHA1

49ae06076532732ee8196f67463202e165089773
SHA256

ce784d1c093f7543584ef86e0973e4b046c87eb5a40619c9f72941007faa8959
SHA512

01d5812f97b1eb0d19a94d2a1184119b639d24eee81eff8ad797f23485ea17dd5d4ab402e254fbf3ff51e30e3b3f75e7759e89ecb83a9e6a822087fcccf1fe88
SSDEEP

1536:8vGF96GZejMuf2XU3+rXMn3BNwOWBak9Sz:8eiXj9SU6C37wOWH4z

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3200	mmdmm.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mmdmm.exe	16d7c031c57e093eb2576ed780e90ffc.exe
File opened for modification	C:\Windows\SysWOW64\mmdmm.exe	16d7c031c57e093eb2576ed780e90ffc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 3200	2280	16d7c031c57e093eb2576ed780e90ffc.exe	69
PID 2280 wrote to memory of 3200	2280	16d7c031c57e093eb2576ed780e90ffc.exe	69
PID 2280 wrote to memory of 3200	2280	16d7c031c57e093eb2576ed780e90ffc.exe	69

C:\Users\Admin\AppData\Local\Temp\16d7c031c57e093eb2576ed780e90ffc.exe
"C:\Users\Admin\AppData\Local\Temp\16d7c031c57e093eb2576ed780e90ffc.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\mmdmm.exe
  C:\Windows\system32\mmdmm.exe 1124 "C:\Users\Admin\AppData\Local\Temp\16d7c031c57e093eb2576ed780e90ffc.exe"
  2⤵
  - Executes dropped EXE
  PID:3200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2280-0-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2280-8-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/3200-7-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download