Analysis
-
max time kernel
118s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
13-10-2024 14:49
Behavioral task
behavioral1
Sample
winupdate.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
winupdate.exe
Resource
win10v2004-20241007-en
General
-
Target
winupdate.exe
-
Size
7.6MB
-
MD5
4667ad84b811400babc982785614bb5f
-
SHA1
0016a4d0e998382722895dee4a062c0c318e37bf
-
SHA256
d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda
-
SHA512
f3276d245eae7a52233e785c9a79cc9de034b89fec7ccf22ba796c2cc8789541e5cfeb0299e8b430b6bfab43a6ecb1c0fc94ac64022320e413925649c454d2cf
-
SSDEEP
196608:MvhBhOurErvI9pWjg/Qc+4o673pNrabeYyzWG+MYnN9sp:K4urEUWjZZ4dDLIeLzWG+TNCp
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2900 winupdate.exe -
resource yara_rule behavioral1/files/0x000500000001998d-22.dat upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2824 wrote to memory of 2900 2824 winupdate.exe 30 PID 2824 wrote to memory of 2900 2824 winupdate.exe 30 PID 2824 wrote to memory of 2900 2824 winupdate.exe 30
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5eb02b8268d6ea28db0ea71bfe24b15d6
SHA186f723fcc4583d7d2bd59ca2749d4b3952cd65a5
SHA25680222651a93099a906be55044024d32e93b841c83554359d6e605d50d11e2e70
SHA512693bbc3c896ad3c6044c832597f946c778e6c6192def3d662803e330209ec1c68d8d33bd82978279ae66b264a892a366183dcef9a3a777e0a6ee450a928268e2