Analysis
-
max time kernel
152s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
30-06-2022 18:03
Static task
static1
Behavioral task
behavioral1
Sample
taskhost.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
taskhost.exe
Resource
win10v2004-20220414-en
0 signatures
0 seconds
General
-
Target
taskhost.exe
-
Size
693KB
-
MD5
d6e447ddcc6f74cac89322ff25e7835e
-
SHA1
9a419d1a7d4a515d03db7f08fdd27e11ae896b11
-
SHA256
97be2d515e01ba66091148456b392f7539b43ab1ba412c493107e93aeda1536a
-
SHA512
f913cac403ff7859dde8f8604617524ddc7227a4477f457b2b9716be7e6ec8b9b2dae2cff75dce4c32f054b561cff224f272af6e4d59df82c1c3cf28ffac645c
Score
8/10
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3664-130-0x0000000000B00000-0x0000000000CAF000-memory.dmp vmprotect behavioral2/memory/3664-131-0x0000000000B00000-0x0000000000CAF000-memory.dmp vmprotect behavioral2/memory/3664-134-0x0000000000B00000-0x0000000000CAF000-memory.dmp vmprotect -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/3664-131-0x0000000000B00000-0x0000000000CAF000-memory.dmp autoit_exe behavioral2/memory/3664-134-0x0000000000B00000-0x0000000000CAF000-memory.dmp autoit_exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskhost.exepid process 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe 3664 taskhost.exe