f2f71ea80d8fff0e80ba423feb76bc8ceedcee04c983ae0af4bdd18de2f54578 | Triage

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 09:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ab90c72ab7a7531a2404cef8be437922.exe
Size

35KB
MD5

ab90c72ab7a7531a2404cef8be437922
SHA1

e768775bc8815579ab2acf007d7bd8c93b59d1f0
SHA256

f2f71ea80d8fff0e80ba423feb76bc8ceedcee04c983ae0af4bdd18de2f54578
SHA512

b1e62159d8a9bd7f4047f48c635e1e330aea2bdf27c1eaf5e9dd18f53dd890f5236769f24e6ef9b50e7e44adf018cc3e7ec67ee4b96ec1218cada06df50f83d6
SSDEEP

768:lV29zaHMz4qxMLBEG784jRTx3KcwXnuS/g5:/2AHMz44MLi74jXacwXr/C

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 2380	1312	ab90c72ab7a7531a2404cef8be437922.exe	28
PID 1312 wrote to memory of 2380	1312	ab90c72ab7a7531a2404cef8be437922.exe	28
PID 1312 wrote to memory of 2380	1312	ab90c72ab7a7531a2404cef8be437922.exe	28
PID 1312 wrote to memory of 2380	1312	ab90c72ab7a7531a2404cef8be437922.exe	28

C:\Users\Admin\AppData\Local\Temp\ab90c72ab7a7531a2404cef8be437922.exe
"C:\Users\Admin\AppData\Local\Temp\ab90c72ab7a7531a2404cef8be437922.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1312-1-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1312-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1312-2-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download