Analysis

  • max time kernel
    140s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    13/07/2024, 20:22

General

  • Target

    62fc1f42f6741730198bbbee636af31f21f1d994e1ec89a3154c5955a2b41673.exe

  • Size

    14.3MB

  • MD5

    287079832c0d4a7966a0d35ee03a9689

  • SHA1

    d69b33d39b8d0d67f4bb5b60f541fe0ea3229568

  • SHA256

    62fc1f42f6741730198bbbee636af31f21f1d994e1ec89a3154c5955a2b41673

  • SHA512

    0cd46c9e43b97ba22bc0ee3666ba408c5cc677511c3e8f2892e4b8ca582886b11a8707679a23fc1e0f39cfdf4f0ecc00ce002181f47ef2ace131e235170ff7e9

  • SSDEEP

    196608:2tH8S4B4hAtkl1czIhgsK+7Gc4uMMywHiBrfkdt4RAiq7Vr5geDQaFGA9iR0vPy9:SHT4BAOIh1K+qc6XF9mDQa8A9ievPNo

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\62fc1f42f6741730198bbbee636af31f21f1d994e1ec89a3154c5955a2b41673.exe
    "C:\Users\Admin\AppData\Local\Temp\62fc1f42f6741730198bbbee636af31f21f1d994e1ec89a3154c5955a2b41673.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2616
    • C:\Users\Admin\AppData\Local\Temp\is-DQPIK.tmp\62fc1f42f6741730198bbbee636af31f21f1d994e1ec89a3154c5955a2b41673.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-DQPIK.tmp\62fc1f42f6741730198bbbee636af31f21f1d994e1ec89a3154c5955a2b41673.tmp" /SL5="$40158,14173373,1339392,C:\Users\Admin\AppData\Local\Temp\62fc1f42f6741730198bbbee636af31f21f1d994e1ec89a3154c5955a2b41673.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\is-3BU90.tmp\_isetup\_isdecmp.dll

    Filesize

    28KB

    MD5

    077cb4461a2767383b317eb0c50f5f13

    SHA1

    584e64f1d162398b7f377ce55a6b5740379c4282

    SHA256

    8287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64

    SHA512

    b1fcb0265697561ef497e6a60fcee99dc5ea0cf02b4010da9f5ed93bce88bdfea6bfe823a017487b8059158464ea29636aad8e5f9dd1e8b8a1b6eaaab670e547

  • \Users\Admin\AppData\Local\Temp\is-DQPIK.tmp\62fc1f42f6741730198bbbee636af31f21f1d994e1ec89a3154c5955a2b41673.tmp

    Filesize

    3.5MB

    MD5

    8f2e1c53fd457d66679686bcb6fd2645

    SHA1

    3e82d384022e0b9c14868de7d40647446bbff883

    SHA256

    18eee38229d5637e3e4d535bf175cca87245fd0d635cd0e2c02b4747208b8ca2

    SHA512

    77c561fdda2fd4e903d451eb652ea744de54c567268114029ceae707f476fb21db14426348ac6c0c60ff3a92e084e641b806d44cd01f4930508a0d81720d49db

  • memory/268-12-0x0000000000400000-0x0000000000790000-memory.dmp

    Filesize

    3.6MB

  • memory/268-14-0x0000000000400000-0x0000000000790000-memory.dmp

    Filesize

    3.6MB

  • memory/2616-0-0x0000000000400000-0x0000000000554000-memory.dmp

    Filesize

    1.3MB

  • memory/2616-2-0x0000000000401000-0x00000000004B7000-memory.dmp

    Filesize

    728KB

  • memory/2616-13-0x0000000000400000-0x0000000000554000-memory.dmp

    Filesize

    1.3MB