Analysis
-
max time kernel
58s -
max time network
58s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
08/05/2022, 15:44
Static task
static1
Behavioral task
behavioral1
Sample
f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe
-
Size
3.4MB
-
MD5
43099e8aa1fc1a891f0e0d3901722d83
-
SHA1
e700821c5443b93c79b790aa4a87306bf1837fc6
-
SHA256
f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e
-
SHA512
1b9ba53653dc310722095f921a9593edd37c460f0a52836f43f15c8cd6685c2b3fb0a7856fe09f02382bca60ed4ebfc2fe525da64985df68ec0daa033ee6bf02
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28 PID 1776 wrote to memory of 1376 1776 f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe"C:\Users\Admin\AppData\Local\Temp\f0aa61702b6bf58598bd2d325ee289810914fe26fe7f634e0dad8b3ad3c1a04e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\tracert.exe"C:\Windows\system32\tracert.exe"2⤵PID:1376
-