Analysis
-
max time kernel
130s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 01:02
Static task
static1
Behavioral task
behavioral1
Sample
81868fa1a24d3222fc0a01b5a2e1632fb6dc72fad1b32a64cea53483ed763147.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
81868fa1a24d3222fc0a01b5a2e1632fb6dc72fad1b32a64cea53483ed763147.exe
Resource
win10v2004-20220901-en
General
-
Target
81868fa1a24d3222fc0a01b5a2e1632fb6dc72fad1b32a64cea53483ed763147.exe
-
Size
146KB
-
MD5
63717ecdb933ff962726cd0e69ad0982
-
SHA1
b94f7c0cb4e003f96730edfed1f8efe1a1a86e42
-
SHA256
81868fa1a24d3222fc0a01b5a2e1632fb6dc72fad1b32a64cea53483ed763147
-
SHA512
5f010bb958974666ad6d7b44032521d15dcebb737de11fc7d10d516239c5b3eab10b063dc96529119557aba2c71521ca41688a8bf52c6c8389c6b2fde06de8e9
-
SSDEEP
3072:httttttttttttttjxttttttDL/AwS5Nm4rgKZP6Qtw8ti40FrTsbuT:VhdeN3lJPifsKT
Malware Config
Signatures
-
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1768 81868fa1a24d3222fc0a01b5a2e1632fb6dc72fad1b32a64cea53483ed763147.exe 1768 81868fa1a24d3222fc0a01b5a2e1632fb6dc72fad1b32a64cea53483ed763147.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1768 81868fa1a24d3222fc0a01b5a2e1632fb6dc72fad1b32a64cea53483ed763147.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1768 wrote to memory of 1284 1768 81868fa1a24d3222fc0a01b5a2e1632fb6dc72fad1b32a64cea53483ed763147.exe 27 PID 1768 wrote to memory of 1284 1768 81868fa1a24d3222fc0a01b5a2e1632fb6dc72fad1b32a64cea53483ed763147.exe 27 PID 1768 wrote to memory of 1284 1768 81868fa1a24d3222fc0a01b5a2e1632fb6dc72fad1b32a64cea53483ed763147.exe 27 PID 1768 wrote to memory of 1284 1768 81868fa1a24d3222fc0a01b5a2e1632fb6dc72fad1b32a64cea53483ed763147.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\81868fa1a24d3222fc0a01b5a2e1632fb6dc72fad1b32a64cea53483ed763147.exe"C:\Users\Admin\AppData\Local\Temp\81868fa1a24d3222fc0a01b5a2e1632fb6dc72fad1b32a64cea53483ed763147.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵PID:1284
-