Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 01:43
Static task
static1
Behavioral task
behavioral1
Sample
883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe
Resource
win7-20220901-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe
Resource
win10v2004-20220901-en
4 signatures
150 seconds
General
-
Target
883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe
-
Size
295KB
-
MD5
3677daf7ec49eb0a38aee32e13a52772
-
SHA1
a269122cfd442d92d2cff850563d00478d74eb9e
-
SHA256
883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142
-
SHA512
c7a5bd6ee5b50e16dbd6ebd1dc813c5c240f10448f7118c37b0d58531a1d76b29ff8db3c3dfb629a2cc85b9ef11bd853cd179ff56e40aadb74057ae3797b8ed1
-
SSDEEP
3072:QP8I6KZSE+FSm5CXDtpk3kFIYjyfOznI9varD9Q:Q/kxdVA+
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2012 set thread context of 1068 2012 883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe 27 PID 1068 set thread context of 1996 1068 883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe 28 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1996 883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe 1996 883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2012 883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe 1068 883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2012 wrote to memory of 1068 2012 883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe 27 PID 2012 wrote to memory of 1068 2012 883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe 27 PID 2012 wrote to memory of 1068 2012 883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe 27 PID 2012 wrote to memory of 1068 2012 883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe 27 PID 2012 wrote to memory of 1068 2012 883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe 27 PID 2012 wrote to memory of 1068 2012 883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe 27 PID 2012 wrote to memory of 1068 2012 883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe 27 PID 2012 wrote to memory of 1068 2012 883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe 27 PID 2012 wrote to memory of 1068 2012 883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe 27 PID 1068 wrote to memory of 1996 1068 883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe 28 PID 1068 wrote to memory of 1996 1068 883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe 28 PID 1068 wrote to memory of 1996 1068 883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe 28 PID 1068 wrote to memory of 1996 1068 883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe 28 PID 1068 wrote to memory of 1996 1068 883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe 28 PID 1068 wrote to memory of 1996 1068 883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe 28 PID 1068 wrote to memory of 1996 1068 883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe 28 PID 1068 wrote to memory of 1996 1068 883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe 28 PID 1996 wrote to memory of 1348 1996 883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe 10 PID 1996 wrote to memory of 1348 1996 883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe 10 PID 1996 wrote to memory of 1348 1996 883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe 10 PID 1996 wrote to memory of 1348 1996 883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe 10
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe"C:\Users\Admin\AppData\Local\Temp\883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exeC:\Users\Admin\AppData\Local\Temp\883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe"C:\Users\Admin\AppData\Local\Temp\883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1996
-
-
-