Analysis
-
max time kernel
72s -
max time network
75s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
17-09-2021 20:57
Static task
static1
Behavioral task
behavioral1
Sample
866d1aeb69daac5e6e4dda938edf8d26.exe
Resource
win7v20210408
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
866d1aeb69daac5e6e4dda938edf8d26.exe
Resource
win10v20210408
0 signatures
0 seconds
General
-
Target
866d1aeb69daac5e6e4dda938edf8d26.exe
-
Size
430KB
-
MD5
866d1aeb69daac5e6e4dda938edf8d26
-
SHA1
184f3ae0508d5004a9e3fe981cbc830092d41ed7
-
SHA256
a41ba93183d03c4cf6b138170fab1d15c306918bb4acd1c2cbc3ee53765e5564
-
SHA512
e488ee1b612c683c72c9ce7d33727d1f6daa6f1bdb599b9f77fd2cf6f0b7122d650a4347bfb836bf4b5e111c92057ecfb91fd517821c32cf7b1fc246ec8bfcee
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
866d1aeb69daac5e6e4dda938edf8d26.exedescription pid process target process PID 664 set thread context of 608 664 866d1aeb69daac5e6e4dda938edf8d26.exe 866d1aeb69daac5e6e4dda938edf8d26.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
866d1aeb69daac5e6e4dda938edf8d26.exepid process 608 866d1aeb69daac5e6e4dda938edf8d26.exe 608 866d1aeb69daac5e6e4dda938edf8d26.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
866d1aeb69daac5e6e4dda938edf8d26.exepid process 664 866d1aeb69daac5e6e4dda938edf8d26.exe 664 866d1aeb69daac5e6e4dda938edf8d26.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
866d1aeb69daac5e6e4dda938edf8d26.exedescription pid process target process PID 664 wrote to memory of 608 664 866d1aeb69daac5e6e4dda938edf8d26.exe 866d1aeb69daac5e6e4dda938edf8d26.exe PID 664 wrote to memory of 608 664 866d1aeb69daac5e6e4dda938edf8d26.exe 866d1aeb69daac5e6e4dda938edf8d26.exe PID 664 wrote to memory of 608 664 866d1aeb69daac5e6e4dda938edf8d26.exe 866d1aeb69daac5e6e4dda938edf8d26.exe PID 664 wrote to memory of 608 664 866d1aeb69daac5e6e4dda938edf8d26.exe 866d1aeb69daac5e6e4dda938edf8d26.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\866d1aeb69daac5e6e4dda938edf8d26.exe"C:\Users\Admin\AppData\Local\Temp\866d1aeb69daac5e6e4dda938edf8d26.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\866d1aeb69daac5e6e4dda938edf8d26.exe"C:\Users\Admin\AppData\Local\Temp\866d1aeb69daac5e6e4dda938edf8d26.exe"2⤵
- Suspicious behavior: EnumeratesProcesses