Analysis
-
max time kernel
24s -
max time network
143s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
18-07-2020 08:54
General
-
Target
c0695c4f73a5a26beaaf5402c949f0be.exe
-
Size
2.3MB
-
MD5
c0695c4f73a5a26beaaf5402c949f0be
-
SHA1
02356f440a5d13768657fe233e48bf9f8c3b1f17
-
SHA256
68313d4b45cc908f541dd581d7b9d1e8ccadcbf205714c12c36b58083ada7345
-
SHA512
eeecb03ee1324968eb8dfa48ece8b45ff80e22cb20c0288a1c4643cacee074e6279d8291b71f02aa38193e40db9f40bc2527b78879dd701440900e9eb6e55aa1
Score
8/10
Malware Config
Signatures
-
Drops startup file 1 IoCs
-
Loads dropped DLL 11 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
JavaScript code in executable 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0695c4f73a5a26beaaf5402c949f0be.exe"C:\Users\Admin\AppData\Local\Temp\c0695c4f73a5a26beaaf5402c949f0be.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\CodeIntegrity\WinSupport\client32.exe"C:\Users\Admin\AppData\Roaming\CodeIntegrity\WinSupport\client32.exe"2⤵
- Loads dropped DLL
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of AdjustPrivilegeToken
-