Analysis
-
max time kernel
133s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 19:23
Behavioral task
behavioral1
Sample
60f3b2ce56ec30465afb439cb98aaef575d5237f3ef9b193571962a70a9af033.exe
Resource
win7-20220812-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
60f3b2ce56ec30465afb439cb98aaef575d5237f3ef9b193571962a70a9af033.exe
Resource
win10v2004-20220901-en
3 signatures
150 seconds
General
-
Target
60f3b2ce56ec30465afb439cb98aaef575d5237f3ef9b193571962a70a9af033.exe
-
Size
166KB
-
MD5
0e25a7c88556ca0ca3dd841e79ad67bf
-
SHA1
43bf9ee523b7e2eaea2407655b30b3e7c4e57b73
-
SHA256
60f3b2ce56ec30465afb439cb98aaef575d5237f3ef9b193571962a70a9af033
-
SHA512
3900b98ee8b6ccf13771c55cb4bd2b95857c2f87553e32fbddd111a45eb39d3a5d8a47a819bdd228adfd7c3b62bacc9944df76ee0fd5029867a316aba6d17bb5
-
SSDEEP
3072:ypWmDUU9d08jjwjc8xW/3uOIK0Z/GcY/byYPIY7u80:yp9Jwjc8AfuOfy/nwbyYg+
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4996-132-0x0000000000400000-0x000000000042B000-memory.dmp upx -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 4996 60f3b2ce56ec30465afb439cb98aaef575d5237f3ef9b193571962a70a9af033.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4996 wrote to memory of 3068 4996 60f3b2ce56ec30465afb439cb98aaef575d5237f3ef9b193571962a70a9af033.exe 32 PID 4996 wrote to memory of 3068 4996 60f3b2ce56ec30465afb439cb98aaef575d5237f3ef9b193571962a70a9af033.exe 32
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\60f3b2ce56ec30465afb439cb98aaef575d5237f3ef9b193571962a70a9af033.exe"C:\Users\Admin\AppData\Local\Temp\60f3b2ce56ec30465afb439cb98aaef575d5237f3ef9b193571962a70a9af033.exe"2⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4996
-