97028cb3c231355edac3f2aefd1b0c4445a8a9473f31be9c6bf87fa43ab24fed

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03-02-2024 22:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d81ee748a32048ac5d09680742e8d70.exe
Size

168KB
MD5

8d81ee748a32048ac5d09680742e8d70
SHA1

bfed8def5880c94251fd8cb43e45a5011bc54f4b
SHA256

97028cb3c231355edac3f2aefd1b0c4445a8a9473f31be9c6bf87fa43ab24fed
SHA512

639408bf32fd0e23dfad811543001b014efbf5c269d11d73f07c8a2905507062a77d0ab1a454e6b86ce47b608ab970e206eeb40d4fec7fe5e2fca5f035b78963
SSDEEP

3072:DHrHofPOlj9sYJbLMEviYivZNnxSKjHhHA0A49dXjOaPQPPIihnXLhtO:PH2GN9VJbLpijxzHq0AujOVPhXLhQ

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2248	8d81ee748a32048ac5d09680742e8d70.exe
2248	8d81ee748a32048ac5d09680742e8d70.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 1204	2248	8d81ee748a32048ac5d09680742e8d70.exe	8
PID 2248 wrote to memory of 1204	2248	8d81ee748a32048ac5d09680742e8d70.exe	8
PID 2248 wrote to memory of 1204	2248	8d81ee748a32048ac5d09680742e8d70.exe	8
PID 2248 wrote to memory of 1204	2248	8d81ee748a32048ac5d09680742e8d70.exe	8

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204
- C:\Users\Admin\AppData\Local\Temp\8d81ee748a32048ac5d09680742e8d70.exe
  "C:\Users\Admin\AppData\Local\Temp\8d81ee748a32048ac5d09680742e8d70.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1204-11-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1204-16-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2248-8-0x0000000002000000-0x0000000002010000-memory.dmp

Filesize
64KB

Download
memory/2248-12-0x0000000077171000-0x0000000077172000-memory.dmp

Filesize
4KB

Download
memory/2248-3-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2248-2-0x00000000002E0000-0x0000000000319000-memory.dmp

Filesize
228KB

Download
memory/2248-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2248-7-0x0000000076320000-0x0000000076430000-memory.dmp

Filesize
1.1MB

Download
memory/2248-1-0x0000000000220000-0x0000000000224000-memory.dmp

Filesize
16KB

Download
memory/2248-9-0x0000000000370000-0x0000000000380000-memory.dmp

Filesize
64KB

Download
memory/2248-10-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2248-4-0x00000000002C0000-0x00000000002D0000-memory.dmp

Filesize
64KB

Download
memory/2248-13-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2248-6-0x000000007716F000-0x0000000077170000-memory.dmp

Filesize
4KB

Download
memory/2248-5-0x0000000077170000-0x0000000077171000-memory.dmp

Filesize
4KB

Download
memory/2248-25-0x00000000771A8000-0x00000000771A9000-memory.dmp

Filesize
4KB

Download
memory/2248-26-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2248-27-0x0000000076320000-0x0000000076430000-memory.dmp

Filesize
1.1MB

Download
memory/2248-28-0x00000000002E0000-0x0000000000319000-memory.dmp

Filesize
228KB

Download