19b5afd87bd565604e00bfc96a05206e11d33518ced6223a762dc68c20c37379 | Triage

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26-01-2024 17:37

Sharing

Report Analysis Logs

General

Target

77f7cc407f8f3e9a8928d4b66a617e3b.exe
Size

79KB
MD5

77f7cc407f8f3e9a8928d4b66a617e3b
SHA1

f3a711bc44256b671f3c48992ae98c662db920d1
SHA256

19b5afd87bd565604e00bfc96a05206e11d33518ced6223a762dc68c20c37379
SHA512

05b230f5a7ffdb94b74e96c6e1b634cbb958982f84bda1f1f47ec4bc95aacdc3610c213a0b5f3ff8db6e595b0ea42812fe9607c9ae665582261a78fab1eafcc8
SSDEEP

1536:4yUos5Ry3CUojzUeZIsajfe0MmSjc9RSD64g+Nj:4yUov3CXabPMHeEd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 6016 wrote to memory of 3880	6016	77f7cc407f8f3e9a8928d4b66a617e3b.exe	86
PID 6016 wrote to memory of 3880	6016	77f7cc407f8f3e9a8928d4b66a617e3b.exe	86
PID 6016 wrote to memory of 3880	6016	77f7cc407f8f3e9a8928d4b66a617e3b.exe	86

C:\Users\Admin\AppData\Local\Temp\77f7cc407f8f3e9a8928d4b66a617e3b.exe
"C:\Users\Admin\AppData\Local\Temp\77f7cc407f8f3e9a8928d4b66a617e3b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6016
- C:\Users\Admin\AppData\Local\Temp\77f7cc407f8f3e9a8928d4b66a617e3b.exe
  "C:\Users\Admin\AppData\Local\Temp\77f7cc407f8f3e9a8928d4b66a617e3b.exe" 1056736769141525477
  2⤵
  PID:3880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3880-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/3880-5-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/6016-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download