005cd16327ee25b54a64dd9cff306a364ef6e64719883a83c150d0bbd3151f45 | Triage

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 21:21

Sharing

Report Analysis Logs

General

Target

1cd3c88f0ea3c6fb552ae096961e8433.exe
Size

48KB
MD5

1cd3c88f0ea3c6fb552ae096961e8433
SHA1

bcf87b9e896c9b4b68cc5456b943e02cd707f31a
SHA256

005cd16327ee25b54a64dd9cff306a364ef6e64719883a83c150d0bbd3151f45
SHA512

d36e0dc8764e88c25609b88e4466b40d208cac512a5e78e1ff4b5b4972ff693a7a4fd567e4dcacd2d1143c82df362c9c727d7629390f38b4f85d1ec54a8483b5
SSDEEP

1536:5smEFnefqKcq+oPmib863gbNsKzZnZO8Is:+LKcqEiblgbNxZr

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2996	2932	1cd3c88f0ea3c6fb552ae096961e8433.exe	16
PID 2932 wrote to memory of 2996	2932	1cd3c88f0ea3c6fb552ae096961e8433.exe	16
PID 2932 wrote to memory of 2996	2932	1cd3c88f0ea3c6fb552ae096961e8433.exe	16
PID 2932 wrote to memory of 2996	2932	1cd3c88f0ea3c6fb552ae096961e8433.exe	16
PID 2932 wrote to memory of 2996	2932	1cd3c88f0ea3c6fb552ae096961e8433.exe	16
PID 2932 wrote to memory of 2996	2932	1cd3c88f0ea3c6fb552ae096961e8433.exe	16
PID 2932 wrote to memory of 2996	2932	1cd3c88f0ea3c6fb552ae096961e8433.exe	16
PID 2932 wrote to memory of 2996	2932	1cd3c88f0ea3c6fb552ae096961e8433.exe	16

C:\Users\Admin\AppData\Local\Temp\1cd3c88f0ea3c6fb552ae096961e8433.exe
"C:\Users\Admin\AppData\Local\Temp\1cd3c88f0ea3c6fb552ae096961e8433.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\1cd3c88f0ea3c6fb552ae096961e8433.exe
  C:\Users\Admin\AppData\Local\Temp\1cd3c88f0ea3c6fb552ae096961e8433.exe
  2⤵
  PID:2996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2996-5-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2996-4-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2996-2-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2996-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download