7aaf2650f6e2914340ca5230eec2da557e4045ce9cf20ada8ba8e4d5d2228d7b | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-03-2024 03:49

Sharing

Report Analysis Logs

General

Target

bfc540e107105f338e3ffd51684a95cb.exe
Size

398KB
MD5

bfc540e107105f338e3ffd51684a95cb
SHA1

69630788640cf3d13123cfddbbde88bbca1091c0
SHA256

7aaf2650f6e2914340ca5230eec2da557e4045ce9cf20ada8ba8e4d5d2228d7b
SHA512

22276b7b30c571c9d7a619196b21a22840652cbd21c59c0dc043485c3ddfc872081822d8bb091c3c76f1c6007000f6d9fe719ff330d6dfe4b13e276226d1f836
SSDEEP

12288:9+4txFPMBur44CyzbwNq0Lr/IJ+StcyM/CCM98:9+4hMA8pgIlLrwJ+bfvM98

Score

1^/10

Malware Config

Signatures

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

bfc540e107105f338e3ffd51684a95cb.exe

pid process

1924 bfc540e107105f338e3ffd51684a95cb.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

bfc540e107105f338e3ffd51684a95cb.exe

description	pid	process	target process
PID 1924 wrote to memory of 2592	1924	bfc540e107105f338e3ffd51684a95cb.exe	bfc540e107105f338e3ffd51684a95cb.exe
PID 1924 wrote to memory of 2592	1924	bfc540e107105f338e3ffd51684a95cb.exe	bfc540e107105f338e3ffd51684a95cb.exe
PID 1924 wrote to memory of 2592	1924	bfc540e107105f338e3ffd51684a95cb.exe	bfc540e107105f338e3ffd51684a95cb.exe
PID 1924 wrote to memory of 2592	1924	bfc540e107105f338e3ffd51684a95cb.exe	bfc540e107105f338e3ffd51684a95cb.exe

C:\Users\Admin\AppData\Local\Temp\bfc540e107105f338e3ffd51684a95cb.exe
"C:\Users\Admin\AppData\Local\Temp\bfc540e107105f338e3ffd51684a95cb.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1924

C:\Users\Admin\AppData\Local\Temp\bfc540e107105f338e3ffd51684a95cb.exe
"C:\Users\Admin\AppData\Local\Temp\bfc540e107105f338e3ffd51684a95cb.exe"
2⤵
PID:2592

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...