Analysis
-
max time kernel
146s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29/10/2022, 22:39
Static task
static1
Behavioral task
behavioral1
Sample
58d5837ac9ee2cd268c4987ae22c4abe920f6bfe73e0e8fe68527b50a17aa74b.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
58d5837ac9ee2cd268c4987ae22c4abe920f6bfe73e0e8fe68527b50a17aa74b.exe
Resource
win10v2004-20220812-en
General
-
Target
58d5837ac9ee2cd268c4987ae22c4abe920f6bfe73e0e8fe68527b50a17aa74b.exe
-
Size
188KB
-
MD5
83c1b41abb71afa8754fecc59efb63c0
-
SHA1
0000b92a4e043eab65a743660dd93564391a77c8
-
SHA256
58d5837ac9ee2cd268c4987ae22c4abe920f6bfe73e0e8fe68527b50a17aa74b
-
SHA512
90af6f0704a621976d9faf804ad1abe34ec8a59d8ccb163c640149c44d147e72a62e5811a327f828fc30a4bb2e93f41a29c97c8f0ab7992619edb510a000d11c
-
SSDEEP
3072:GJR2kkjIOhEtoOjpftI5iYAqWTUNISxRFvbqIJRUfBbNi773yRZDR/y:6ckwh2jLOAbT0ICv/Ruba7+RK
Malware Config
Signatures
-
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3868 58d5837ac9ee2cd268c4987ae22c4abe920f6bfe73e0e8fe68527b50a17aa74b.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3868 wrote to memory of 1960 3868 58d5837ac9ee2cd268c4987ae22c4abe920f6bfe73e0e8fe68527b50a17aa74b.exe 83 PID 3868 wrote to memory of 1960 3868 58d5837ac9ee2cd268c4987ae22c4abe920f6bfe73e0e8fe68527b50a17aa74b.exe 83 PID 3868 wrote to memory of 1960 3868 58d5837ac9ee2cd268c4987ae22c4abe920f6bfe73e0e8fe68527b50a17aa74b.exe 83 PID 3868 wrote to memory of 1960 3868 58d5837ac9ee2cd268c4987ae22c4abe920f6bfe73e0e8fe68527b50a17aa74b.exe 83 PID 3868 wrote to memory of 1960 3868 58d5837ac9ee2cd268c4987ae22c4abe920f6bfe73e0e8fe68527b50a17aa74b.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\58d5837ac9ee2cd268c4987ae22c4abe920f6bfe73e0e8fe68527b50a17aa74b.exe"C:\Users\Admin\AppData\Local\Temp\58d5837ac9ee2cd268c4987ae22c4abe920f6bfe73e0e8fe68527b50a17aa74b.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵PID:1960
-