Analysis
-
max time kernel
83s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
31-08-2022 02:51
Static task
static1
Behavioral task
behavioral1
Sample
9abf44c3ad590c8138af6f6f4a990f2d.exe
Resource
win7-20220812-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
9abf44c3ad590c8138af6f6f4a990f2d.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
9abf44c3ad590c8138af6f6f4a990f2d.exe
-
Size
728KB
-
MD5
9abf44c3ad590c8138af6f6f4a990f2d
-
SHA1
935c17b477a05119675f0eea18e805cada7151c0
-
SHA256
88ece67c89bf10fe005fba4035ba82d93917b6196b7e8a20de6d17dd3181a9ab
-
SHA512
b081797a8fbfafe09ff07955365e6383736e263920e858bdce274187d1f72dda311cc9edac983434a671d00243141614f06f182d4cf84121812cebad7de43199
-
SSDEEP
12288:USqg5SmF75enOrObWmsRHIztZwAQMev5Be4txB49nHp/cbOeaEz/R2G:6mZ5JObWmsRWtZw2GBxB49nHlcoo/RF
Score
1/10
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
9abf44c3ad590c8138af6f6f4a990f2d.exepid process 5056 9abf44c3ad590c8138af6f6f4a990f2d.exe 5056 9abf44c3ad590c8138af6f6f4a990f2d.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
9abf44c3ad590c8138af6f6f4a990f2d.exedescription pid process target process PID 5056 wrote to memory of 4296 5056 9abf44c3ad590c8138af6f6f4a990f2d.exe 9abf44c3ad590c8138af6f6f4a990f2d.exe PID 5056 wrote to memory of 4296 5056 9abf44c3ad590c8138af6f6f4a990f2d.exe 9abf44c3ad590c8138af6f6f4a990f2d.exe PID 5056 wrote to memory of 4296 5056 9abf44c3ad590c8138af6f6f4a990f2d.exe 9abf44c3ad590c8138af6f6f4a990f2d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9abf44c3ad590c8138af6f6f4a990f2d.exe"C:\Users\Admin\AppData\Local\Temp\9abf44c3ad590c8138af6f6f4a990f2d.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\9abf44c3ad590c8138af6f6f4a990f2d.exe"C:\Users\Admin\AppData\Local\Temp\9abf44c3ad590c8138af6f6f4a990f2d.exe"2⤵PID:4296