5518980510be79f425518145724d0e7f7564854667cdb8b7d9f6c0112401eebd | Triage

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 08:38

Sharing

Report Analysis Logs

General

Target

LocoyAutoUpdate.exe
Size

196KB
MD5

3dc7766f76a3cd3f11c5973aa0720015
SHA1

ade0289ab4c7e63b283667cf8b322b06bd7bfc05
SHA256

96ef56ff9172fbc20e6f29fcdc7f8298017d21fdec494b533805ff06225d1c9a
SHA512

76391966d467361f01c1d815f8fbb5b6f0cb6a5e932247bb21a44bbb689175ddf3fbb149a8a037b48083833cbb38b34ed5aa5733ae0786bfa4a9fb7b000a6749
SSDEEP

3072:W6dxgGGDwR093q9M/+xTZVWhYlSONy3u79gQFN7xN7XAnU:VwDH3q9M/+xTZVW+HrH7L7wU

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2040	2900	LocoyAutoUpdate.exe	28
PID 2900 wrote to memory of 2040	2900	LocoyAutoUpdate.exe	28
PID 2900 wrote to memory of 2040	2900	LocoyAutoUpdate.exe	28

C:\Users\Admin\AppData\Local\Temp\LocoyAutoUpdate.exe
"C:\Users\Admin\AppData\Local\Temp\LocoyAutoUpdate.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 388
  2⤵
  PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-2-0x0000000001CA0000-0x0000000001CA1000-memory.dmp

Filesize
4KB

Download
memory/2900-0-0x000007FEF591E000-0x000007FEF591F000-memory.dmp

Filesize
4KB

Download
memory/2900-1-0x000007FEF5660000-0x000007FEF5FFD000-memory.dmp

Filesize
9.6MB

Download
memory/2900-3-0x000007FEF5660000-0x000007FEF5FFD000-memory.dmp

Filesize
9.6MB

Download