Analysis
-
max time kernel
43s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20/10/2022, 18:18
Behavioral task
behavioral1
Sample
9671a582922f51efda4753bd9c5908be22df73ac49a2a2f189443714ca58511c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9671a582922f51efda4753bd9c5908be22df73ac49a2a2f189443714ca58511c.exe
Resource
win10v2004-20220812-en
General
-
Target
9671a582922f51efda4753bd9c5908be22df73ac49a2a2f189443714ca58511c.exe
-
Size
167KB
-
MD5
901e312b12f8f7157ca6d3344d2f3405
-
SHA1
7dcde5189970b0946360b57e97f823287602f6bf
-
SHA256
9671a582922f51efda4753bd9c5908be22df73ac49a2a2f189443714ca58511c
-
SHA512
ce588b0ed713fa00e27d0491c8a211bf812aa5f18f91bb97e908302bf7e80a28fa3c74678a8079aa9f681b8c904235ca863203b18e8b8992335e15ca82c5b4df
-
SSDEEP
1536:hwWgEEXv9XwZU1fMpL96l/UXxvuri65kwYFgnfxDaEGvYMeEJJwBnn1G3TS64a6D:+E2v2a1fw96BIupkLYfx+E0VG1KSoS
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/768-54-0x0000000000400000-0x000000000042B000-memory.dmp upx -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 768 9671a582922f51efda4753bd9c5908be22df73ac49a2a2f189443714ca58511c.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 768 wrote to memory of 1216 768 9671a582922f51efda4753bd9c5908be22df73ac49a2a2f189443714ca58511c.exe 13 PID 768 wrote to memory of 1216 768 9671a582922f51efda4753bd9c5908be22df73ac49a2a2f189443714ca58511c.exe 13
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\9671a582922f51efda4753bd9c5908be22df73ac49a2a2f189443714ca58511c.exe"C:\Users\Admin\AppData\Local\Temp\9671a582922f51efda4753bd9c5908be22df73ac49a2a2f189443714ca58511c.exe"2⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:768
-