Analysis
-
max time kernel
43s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-07-2022 18:35
Static task
static1
Behavioral task
behavioral1
Sample
3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe
-
Size
1.2MB
-
MD5
f81c3c7143568ef80f9d5aa9c26fe3d9
-
SHA1
57b0791a8ae2b1e6f8f3f06778efc67c27f67de3
-
SHA256
3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14
-
SHA512
2168eec2d34eaca4887d16103efe57d3869eab8a518f894df211515c686632af701bf6bdc04c282339a460e422723565c3f7799d71e6bbacf73ac70c10d67575
Score
1/10
Malware Config
Signatures
-
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exepid process 1664 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe 1664 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe 1664 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exepid process 1664 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe 1664 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe 1664 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exedescription pid process target process PID 1664 wrote to memory of 1524 1664 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe PID 1664 wrote to memory of 1524 1664 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe PID 1664 wrote to memory of 1524 1664 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe PID 1664 wrote to memory of 1524 1664 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe PID 1664 wrote to memory of 1340 1664 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe PID 1664 wrote to memory of 1340 1664 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe PID 1664 wrote to memory of 1340 1664 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe PID 1664 wrote to memory of 1340 1664 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe PID 1664 wrote to memory of 1404 1664 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe PID 1664 wrote to memory of 1404 1664 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe PID 1664 wrote to memory of 1404 1664 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe PID 1664 wrote to memory of 1404 1664 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe PID 1664 wrote to memory of 1672 1664 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe PID 1664 wrote to memory of 1672 1664 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe PID 1664 wrote to memory of 1672 1664 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe PID 1664 wrote to memory of 1672 1664 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe PID 1664 wrote to memory of 1144 1664 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe PID 1664 wrote to memory of 1144 1664 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe PID 1664 wrote to memory of 1144 1664 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe PID 1664 wrote to memory of 1144 1664 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe PID 1664 wrote to memory of 1208 1664 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe PID 1664 wrote to memory of 1208 1664 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe PID 1664 wrote to memory of 1208 1664 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe PID 1664 wrote to memory of 1208 1664 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe 3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe"C:\Users\Admin\AppData\Local\Temp\3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe"C:\Users\Admin\AppData\Local\Temp\3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe"C:\Users\Admin\AppData\Local\Temp\3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe"C:\Users\Admin\AppData\Local\Temp\3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe"C:\Users\Admin\AppData\Local\Temp\3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe"C:\Users\Admin\AppData\Local\Temp\3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe"C:\Users\Admin\AppData\Local\Temp\3adce4b284295dff6b69a9573a03d604da7174fe625b8952ef3d6145846ffc14.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1664-54-0x0000000076011000-0x0000000076013000-memory.dmpFilesize
8KB