6c5b61df93834a15b005c19d5214594a0fb00cd9f3492f2d29e7d7e1636119e8 | Triage

Analysis

max time kernel
117s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/01/2024, 20:19

Sharing

Report Analysis Logs

General

Target

3efc8b65dc0690a506612811d833239d.exe
Size

873KB
MD5

3efc8b65dc0690a506612811d833239d
SHA1

e5a1353e48f1bd785345846d0fee3b4e1da338a8
SHA256

6c5b61df93834a15b005c19d5214594a0fb00cd9f3492f2d29e7d7e1636119e8
SHA512

67bbd0e62f2113c7733b67a1a5ffd3fffbfe3cf668630789240ab2a1cec50cc8651793d88b8843dc1b49dc8d2245c26f57cd668c408db47362d1f334d3512513
SSDEEP

24576:8aOZyo29f/KdErc8lzhtTQ6WDLZmN1VUZm:8aOZyN9jr9zht1WXZmXiZm

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2988	ED5B.tmp

Executes dropped EXE 1 IoCs

pid	Process
2988	ED5B.tmp

Loads dropped DLL 1 IoCs

pid	Process
2708	3efc8b65dc0690a506612811d833239d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2988	2708	3efc8b65dc0690a506612811d833239d.exe	29
PID 2708 wrote to memory of 2988	2708	3efc8b65dc0690a506612811d833239d.exe	29
PID 2708 wrote to memory of 2988	2708	3efc8b65dc0690a506612811d833239d.exe	29
PID 2708 wrote to memory of 2988	2708	3efc8b65dc0690a506612811d833239d.exe	29

C:\Users\Admin\AppData\Local\Temp\3efc8b65dc0690a506612811d833239d.exe
"C:\Users\Admin\AppData\Local\Temp\3efc8b65dc0690a506612811d833239d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Users\Admin\AppData\Local\Temp\ED5B.tmp
  "C:\Users\Admin\AppData\Local\Temp\ED5B.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\ED5B.tmp

Filesize
873KB

MD5
11120bafed7fcec52f76be0631246a88

SHA1
6a3d14d23ed83c236c53bdb0017a6a6c2729a637

SHA256
8130832f6937e73711fe715f22acfc656b20c3fb409cc74587fc341edb4959e8

SHA512
f5033fb35f3d20ca2c5b622cb526fdd00d923900bb38e76579608112d95887a274296c4df4bbf0f51f9ca2b46ce62acf87600288b2839b8b97ea75a5b3891f78

Download Submit