d355872db38fedc6096c3a767b6aa11b7f51d9522ebd27f0e4ca8f3eed12a0bb | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 23:06

Sharing

Report Analysis Logs

General

Target

3b4a7a1cb3524df015d7d7e9b25393d1.exe
Size

1.9MB
MD5

3b4a7a1cb3524df015d7d7e9b25393d1
SHA1

4b4bd5da744a56bc96fec2854b618f05565ed417
SHA256

d355872db38fedc6096c3a767b6aa11b7f51d9522ebd27f0e4ca8f3eed12a0bb
SHA512

59ce19f3ac55ef7af8172242d70ef19e64ed29e2ed806a314f56408fe80b37184435bac85131088fb3f80b4513f02ecdd27e69fdddce2e7f32ed9a53fc64eb05
SSDEEP

49152:Qoa1taC070dMvyiVOiwJXiKRsjoteBYwBA/32:Qoa1taC0Nv7zwJXLREoC9H

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
752	B08.tmp

Executes dropped EXE 1 IoCs

pid	Process
752	B08.tmp

Loads dropped DLL 1 IoCs

pid	Process
2940	3b4a7a1cb3524df015d7d7e9b25393d1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 752	2940	3b4a7a1cb3524df015d7d7e9b25393d1.exe	28
PID 2940 wrote to memory of 752	2940	3b4a7a1cb3524df015d7d7e9b25393d1.exe	28
PID 2940 wrote to memory of 752	2940	3b4a7a1cb3524df015d7d7e9b25393d1.exe	28
PID 2940 wrote to memory of 752	2940	3b4a7a1cb3524df015d7d7e9b25393d1.exe	28

C:\Users\Admin\AppData\Local\Temp\3b4a7a1cb3524df015d7d7e9b25393d1.exe
"C:\Users\Admin\AppData\Local\Temp\3b4a7a1cb3524df015d7d7e9b25393d1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Users\Admin\AppData\Local\Temp\B08.tmp
  "C:\Users\Admin\AppData\Local\Temp\B08.tmp" --splashC:\Users\Admin\AppData\Local\Temp\3b4a7a1cb3524df015d7d7e9b25393d1.exe 2C73BF0D2DD07CC53980C403FA45EB5E8A13AFC7E8DCC98D231FA34E4261EDCF2231E2F517FB7F8572113D02DB156D09CD7161FA0619C74E215B7F23A7CAC603
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/752-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/2940-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download