Analysis
-
max time kernel
43s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 19:27
Behavioral task
behavioral1
Sample
Voice-ai-х64.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Voice-ai-х64.exe
Resource
win10v2004-20240426-en
General
-
Target
Voice-ai-х64.exe
-
Size
65.6MB
-
MD5
bc42dea5caba79387c7039165291736a
-
SHA1
1e0a22af38ad8256659e31f5aa4db391ec93cb76
-
SHA256
97320f1dedb891efadb26a9c40708b37aa3ceac48ba1a7c930dfb8879a6cde39
-
SHA512
e509de5acbfb2b0a7e25029fd8d5d519d8b28fdb426e1dbf6fdb96fe5a50c6bd91ef5930365d0251f8dc7cd63beed99e919a01075eb9cc4b2ea4496af722b7b2
-
SSDEEP
1572864:VpQ8d/oyVQFQeA4NlY49Ze6ZPSVss0bIRDZNOqgNBcsM1WT:bEJPZi/DDaI1M
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2420 Voice-ai-х64.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3020 wrote to memory of 2420 3020 Voice-ai-х64.exe 28 PID 3020 wrote to memory of 2420 3020 Voice-ai-х64.exe 28 PID 3020 wrote to memory of 2420 3020 Voice-ai-х64.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Voice-ai-х64.exe"C:\Users\Admin\AppData\Local\Temp\Voice-ai-х64.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\Voice-ai-х64.exe"C:\Users\Admin\AppData\Local\Temp\Voice-ai-х64.exe"2⤵
- Loads dropped DLL
PID:2420
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD519e6d310c1bd0578d468a888d3ec0e3d
SHA132561ad9b89dc9e9a086569780890ad10337e698
SHA256f4609ec3bbcc74ed9257e3440ec15adf3061f7162a89e4e9a370e1c2273370a1
SHA5124a8332c22a40a170ea83fc8cfd5b8a0ed0df1d59fd22ebe10088ba0be78cc0e91a537d7085549a4d06204cbe77e83154a812daed885c25aa4b4cb4aca5b9cc85