Analysis
-
max time kernel
126s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20-10-2022 14:59
Static task
static1
Behavioral task
behavioral1
Sample
8ca5909a3807af0e37b2b9457703dfa71a01f3ff828bb43582118919ae7def40.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8ca5909a3807af0e37b2b9457703dfa71a01f3ff828bb43582118919ae7def40.exe
Resource
win10v2004-20220812-en
General
-
Target
8ca5909a3807af0e37b2b9457703dfa71a01f3ff828bb43582118919ae7def40.exe
-
Size
165KB
-
MD5
96522a46327cc32174753be6f64617b5
-
SHA1
d1b89943c44e7bc5e03c4c45ae863e1d650ca044
-
SHA256
8ca5909a3807af0e37b2b9457703dfa71a01f3ff828bb43582118919ae7def40
-
SHA512
5799020c06ebdeaf0cf01d92d813268cfa4581b4d118e18aa79b21e0f7a1d0da566f3630f62a6950b15ebd470203e94d66aa923b6eb8cd71a4e9bddd32157bb9
-
SSDEEP
3072:knCTkb/fk2G43QJbDzKuYtBY8U61LjU2addcvzBteh3QeE5BYMOnVts3aS6e:knCs02G43aDjYtBK61LjU2givzBk/E5d
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4652 8ca5909a3807af0e37b2b9457703dfa71a01f3ff828bb43582118919ae7def40.exe 4652 8ca5909a3807af0e37b2b9457703dfa71a01f3ff828bb43582118919ae7def40.exe 4652 8ca5909a3807af0e37b2b9457703dfa71a01f3ff828bb43582118919ae7def40.exe 4652 8ca5909a3807af0e37b2b9457703dfa71a01f3ff828bb43582118919ae7def40.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4652 wrote to memory of 512 4652 8ca5909a3807af0e37b2b9457703dfa71a01f3ff828bb43582118919ae7def40.exe 40 PID 4652 wrote to memory of 512 4652 8ca5909a3807af0e37b2b9457703dfa71a01f3ff828bb43582118919ae7def40.exe 40 PID 4652 wrote to memory of 512 4652 8ca5909a3807af0e37b2b9457703dfa71a01f3ff828bb43582118919ae7def40.exe 40 PID 4652 wrote to memory of 512 4652 8ca5909a3807af0e37b2b9457703dfa71a01f3ff828bb43582118919ae7def40.exe 40
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\8ca5909a3807af0e37b2b9457703dfa71a01f3ff828bb43582118919ae7def40.exe"C:\Users\Admin\AppData\Local\Temp\8ca5909a3807af0e37b2b9457703dfa71a01f3ff828bb43582118919ae7def40.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4652
-