7466b023a2b8f943bb2a55cc90e96914c10cb66d740173bd5d7725ad8d8ebc2c | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 01:48

Sharing

Report Analysis Logs

General

Target

7610ca3d58ed06a8318553d9ef4c503a.exe
Size

2.5MB
MD5

7610ca3d58ed06a8318553d9ef4c503a
SHA1

c14264320f54510ffb5e4dc9b44accabe69a32b6
SHA256

7466b023a2b8f943bb2a55cc90e96914c10cb66d740173bd5d7725ad8d8ebc2c
SHA512

a58e933b0337f8c1fc4158a78dcebccfe47064ee5502d04944f2efcf2768594c940f9f26fcef539fd9b9d067970c87354d3914e43c146a82d8a9d56f9400fb9e
SSDEEP

49152:ylY613CTw8WVeItnpQgon1w0AN+van9AMRFIjiavh+2:ylQIBpQAw4HsC2

Score

1^/10

Malware Config

Signatures

Runs net.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2072	2028	7610ca3d58ed06a8318553d9ef4c503a.exe	28
PID 2028 wrote to memory of 2072	2028	7610ca3d58ed06a8318553d9ef4c503a.exe	28
PID 2028 wrote to memory of 2072	2028	7610ca3d58ed06a8318553d9ef4c503a.exe	28
PID 2028 wrote to memory of 2072	2028	7610ca3d58ed06a8318553d9ef4c503a.exe	28
PID 2028 wrote to memory of 2072	2028	7610ca3d58ed06a8318553d9ef4c503a.exe	28
PID 2028 wrote to memory of 2072	2028	7610ca3d58ed06a8318553d9ef4c503a.exe	28
PID 2028 wrote to memory of 2072	2028	7610ca3d58ed06a8318553d9ef4c503a.exe	28
PID 2072 wrote to memory of 2156	2072	Net.exe	30
PID 2072 wrote to memory of 2156	2072	Net.exe	30
PID 2072 wrote to memory of 2156	2072	Net.exe	30
PID 2072 wrote to memory of 2156	2072	Net.exe	30
PID 2072 wrote to memory of 2156	2072	Net.exe	30
PID 2072 wrote to memory of 2156	2072	Net.exe	30
PID 2072 wrote to memory of 2156	2072	Net.exe	30

C:\Users\Admin\AppData\Local\Temp\7610ca3d58ed06a8318553d9ef4c503a.exe
"C:\Users\Admin\AppData\Local\Temp\7610ca3d58ed06a8318553d9ef4c503a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\Net.exe
  Net Stop PcaSvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 Stop PcaSvc
    3⤵
    PID:2156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2028-2-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download