Analysis
-
max time kernel
0s -
max time network
2s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
14-11-2021 15:51
Errors
Reason
platform exec: Reading agent response: read tcp 10.127.0.1:35992->10.127.0.101:8000: read: connection timed out
General
-
Target
1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe
-
Size
22KB
-
MD5
7906dc475a8ae55ffb5af7fd3ac8f10a
-
SHA1
e7304e2436dc0eddddba229f1ec7145055030151
-
SHA256
1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367
-
SHA512
c087b3107295095e9aca527d02b74c067e96ca5daf5457e465f8606dbf4809027faedf65d77868f6fb8bb91a1438e3d0169e59efddf1439bbd3adb3e23a739a1
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe"C:\Users\Admin\AppData\Local\Temp\1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection