Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15-12-2024 13:36
Behavioral task
behavioral1
Sample
Plate Builder 2.43.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Plate Builder 2.43.exe
Resource
win10v2004-20241007-en
General
-
Target
Plate Builder 2.43.exe
-
Size
6.1MB
-
MD5
80a42d6794552834211c27b19e34fbf2
-
SHA1
5ef48c9fbf8752623d0674f9e974b93513339684
-
SHA256
23ee84ff80b7ab85a636aa03e7b3c396a34b5200470a2e151c86036809f92fd6
-
SHA512
1f2da2b74dd228d3e763c64b73cd1723c9851953853f3f17a45529781cbbc5152c11ae27062f0bc491f3aab71b80585a11840c22284f52422fbe712b268d63fd
-
SSDEEP
196608:8HnFIm/leN/FJMIDJf0gsAGK4R0nAKLYzr5:eqp/Fqyf0gstwAKO
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2352 Plate Builder 2.43.exe -
resource yara_rule behavioral1/files/0x000d000000018683-21.dat upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2548 wrote to memory of 2352 2548 Plate Builder 2.43.exe 30 PID 2548 wrote to memory of 2352 2548 Plate Builder 2.43.exe 30 PID 2548 wrote to memory of 2352 2548 Plate Builder 2.43.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Plate Builder 2.43.exe"C:\Users\Admin\AppData\Local\Temp\Plate Builder 2.43.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\Plate Builder 2.43.exe"C:\Users\Admin\AppData\Local\Temp\Plate Builder 2.43.exe"2⤵
- Loads dropped DLL
PID:2352
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5178a0f45fde7db40c238f1340a0c0ec0
SHA1dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe
SHA2569fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed
SHA5124b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee