19b5afd87bd565604e00bfc96a05206e11d33518ced6223a762dc68c20c37379 | Triage

Analysis

max time kernel
122s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 17:37

Sharing

Report Analysis Logs

General

Target

77f7cc407f8f3e9a8928d4b66a617e3b.exe
Size

79KB
MD5

77f7cc407f8f3e9a8928d4b66a617e3b
SHA1

f3a711bc44256b671f3c48992ae98c662db920d1
SHA256

19b5afd87bd565604e00bfc96a05206e11d33518ced6223a762dc68c20c37379
SHA512

05b230f5a7ffdb94b74e96c6e1b634cbb958982f84bda1f1f47ec4bc95aacdc3610c213a0b5f3ff8db6e595b0ea42812fe9607c9ae665582261a78fab1eafcc8
SSDEEP

1536:4yUos5Ry3CUojzUeZIsajfe0MmSjc9RSD64g+Nj:4yUov3CXabPMHeEd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2544	2896	77f7cc407f8f3e9a8928d4b66a617e3b.exe	29
PID 2896 wrote to memory of 2544	2896	77f7cc407f8f3e9a8928d4b66a617e3b.exe	29
PID 2896 wrote to memory of 2544	2896	77f7cc407f8f3e9a8928d4b66a617e3b.exe	29
PID 2896 wrote to memory of 2544	2896	77f7cc407f8f3e9a8928d4b66a617e3b.exe	29

C:\Users\Admin\AppData\Local\Temp\77f7cc407f8f3e9a8928d4b66a617e3b.exe
"C:\Users\Admin\AppData\Local\Temp\77f7cc407f8f3e9a8928d4b66a617e3b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Users\Admin\AppData\Local\Temp\77f7cc407f8f3e9a8928d4b66a617e3b.exe
  "C:\Users\Admin\AppData\Local\Temp\77f7cc407f8f3e9a8928d4b66a617e3b.exe" 1056736769141525477
  2⤵
  PID:2544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2544-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2544-5-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2544-6-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2896-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download