Analysis
- max time kernel
25s - resource
win10v191014 - submitted
10/01/2020, 15:50
Task
task1
Sample
prospz.exe
Resource
win10v191014
0 signatures
General
- Target prospz.exe
- Sample200110-lz8l2na1bx
- SHA256 549001b9fb2857bc301c861db4fe53f4e60de6302f69bef42fc1d50b35d395b5
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 68 propseyz.exe - NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\prospeuo\propseyz.exe:ZoneIdentifier prospz.exe - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4940 prospz.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4940 wrote to memory of 68 4940 prospz.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\prospz.exe"C:\Users\Admin\AppData\Local\Temp\prospz.exe"1⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Roaming\prospeuo\propseyz.exe"C:\Users\Admin\AppData\Roaming\prospeuo\propseyz.exe"2⤵
- Executes dropped EXE
PID:68
-