Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
20-10-2024 02:07
Behavioral task
behavioral1
Sample
4998131d9da04240464355e09181f10dc42234fc08f58d710b4d821ea89fc635.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4998131d9da04240464355e09181f10dc42234fc08f58d710b4d821ea89fc635.exe
Resource
win10v2004-20241007-en
General
-
Target
4998131d9da04240464355e09181f10dc42234fc08f58d710b4d821ea89fc635.exe
-
Size
19.8MB
-
MD5
ddef08ea0d2d4d3fcb1833864908de42
-
SHA1
300566f50769baab1db9abc1b7bf2fc297489b67
-
SHA256
4998131d9da04240464355e09181f10dc42234fc08f58d710b4d821ea89fc635
-
SHA512
b1c2487fd01c6ad41a91d03c3625e36beee0af5035fddf6f3f66f9335f45c2fcd0c3f3a6857e8f07a643b04479f4a683b8c40cec30138124a360a04cd1eb09b9
-
SSDEEP
393216:0tY/KbHN7xZQNWFCemhZ2YsHFUK2JbInEroXmfEqirRRoYJtNITaZWuNY82HqtYR:082ZQ0FCeiZ2YwUlJkErU0wvxtNLzNYH
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2312 4998131d9da04240464355e09181f10dc42234fc08f58d710b4d821ea89fc635.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1532 wrote to memory of 2312 1532 4998131d9da04240464355e09181f10dc42234fc08f58d710b4d821ea89fc635.exe 29 PID 1532 wrote to memory of 2312 1532 4998131d9da04240464355e09181f10dc42234fc08f58d710b4d821ea89fc635.exe 29 PID 1532 wrote to memory of 2312 1532 4998131d9da04240464355e09181f10dc42234fc08f58d710b4d821ea89fc635.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\4998131d9da04240464355e09181f10dc42234fc08f58d710b4d821ea89fc635.exe"C:\Users\Admin\AppData\Local\Temp\4998131d9da04240464355e09181f10dc42234fc08f58d710b4d821ea89fc635.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\4998131d9da04240464355e09181f10dc42234fc08f58d710b4d821ea89fc635.exe"C:\Users\Admin\AppData\Local\Temp\4998131d9da04240464355e09181f10dc42234fc08f58d710b4d821ea89fc635.exe"2⤵
- Loads dropped DLL
PID:2312
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD57e9d14aa762a46bb5ebac14fbaeaa238
SHA1a5d90a7df9b90bdd8a84d7dc5066e4ea64ceb3d9
SHA256e456ef44b261f895a01efb52d26c7a0c7d7d465b647a7b5592708ebf693f12a3
SHA512280f16348df1c0953bbc6f37ff277485351171d0545ebe469bacd106d907917f87584154aec0f193f37322bc93ac5433cd9a5b5c7f47367176e5a8b19bbd5023