94a47191fb3a307fdaa84a1f8f31d8e1b4b79b34048814725c373e54f3d4e37a

Analysis

max time kernel
140s
max time network
127s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

pvzHE-Launcher.exe
Size

1.7MB
MD5

477c0edf4d9a20eb949582457996b2e2
SHA1

09030647039b6c76128759133bafc3e3ddee7f2e
SHA256

394360c438692fd46d2576e51a87ef09a6643b491e5cc6ee405ea5575905bca5
SHA512

72f19fe6e2e60ffcbcd3e9645ff52cdaf3d1722df3a5a74d6ff1c06250e6629e3936149597a07344902bda1f02b435237965b53ec38e90a51a190bb0187712cc
SSDEEP

24576:q2uTu15U8PHEWUS+kBkWrzaqH6qQb2gCMgHLsDnzD+MOvdaWsQs3YNe5ZX5cFpeU:dbXPkWzqqbXHLpdaWV4epj

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2552	PlantsVsZombies.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2552	3008	pvzHE-Launcher.exe	28
PID 3008 wrote to memory of 2552	3008	pvzHE-Launcher.exe	28
PID 3008 wrote to memory of 2552	3008	pvzHE-Launcher.exe	28
PID 3008 wrote to memory of 2552	3008	pvzHE-Launcher.exe	28
PID 3008 wrote to memory of 2552	3008	pvzHE-Launcher.exe	28
PID 3008 wrote to memory of 2552	3008	pvzHE-Launcher.exe	28
PID 3008 wrote to memory of 2552	3008	pvzHE-Launcher.exe	28

C:\Users\Admin\AppData\Local\Temp\pvzHE-Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\pvzHE-Launcher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Users\Admin\AppData\Local\Temp\PlantsVsZombies.exe
  "PlantsVsZombies.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2552-0-0x0000000000400000-0x0000000000FC8000-memory.dmp

Filesize
11.8MB

Download
memory/2552-2-0x00000000028D0000-0x00000000028DA000-memory.dmp

Filesize
40KB

Download
memory/2552-1-0x00000000028D0000-0x00000000028DA000-memory.dmp

Filesize
40KB

Download
memory/2552-3-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/2552-173-0x0000000000400000-0x0000000000FC8000-memory.dmp

Filesize
11.8MB

Download
memory/2552-174-0x00000000028D0000-0x00000000028DA000-memory.dmp

Filesize
40KB

Download
memory/2552-175-0x00000000028D0000-0x00000000028DA000-memory.dmp

Filesize
40KB

Download
memory/2552-176-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/2552-177-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/2552-178-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/2552-179-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/2552-180-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/2552-181-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/2552-182-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/2552-183-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/2552-184-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/2552-185-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/2552-186-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/2552-187-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/2552-188-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/2552-189-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/2552-190-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads