Analysis
-
max time kernel
91s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 12:06
Static task
static1
Behavioral task
behavioral1
Sample
79c3edfacbd61c56e01d49ed1e7d97ad47bbc425819ea2752c3e7449901916a6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
79c3edfacbd61c56e01d49ed1e7d97ad47bbc425819ea2752c3e7449901916a6.exe
Resource
win10v2004-20220901-en
General
-
Target
79c3edfacbd61c56e01d49ed1e7d97ad47bbc425819ea2752c3e7449901916a6.exe
-
Size
522KB
-
MD5
9cae78a09b221732d12ed69b545a9598
-
SHA1
af1c06c38f33e49aa4a81ee51ab568d5d72597e4
-
SHA256
79c3edfacbd61c56e01d49ed1e7d97ad47bbc425819ea2752c3e7449901916a6
-
SHA512
ee41766be90599ecf215849fe0fceaac248a4b532fe917b72667a5c9aec5e68ad8c9db24495fa96ee064ce0d0591203e3e4580075544cff59b331fe98134710d
-
SSDEEP
12288:pjOBhLR1c9rMZ39oFrny18xQqpx8O5tI:p0D1finatqpx8
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
79c3edfacbd61c56e01d49ed1e7d97ad47bbc425819ea2752c3e7449901916a6.exedescription pid process target process PID 1376 wrote to memory of 3160 1376 79c3edfacbd61c56e01d49ed1e7d97ad47bbc425819ea2752c3e7449901916a6.exe 79c3edfacbd61c56e01d49ed1e7d97ad47bbc425819ea2752c3e7449901916a6.exe PID 1376 wrote to memory of 3160 1376 79c3edfacbd61c56e01d49ed1e7d97ad47bbc425819ea2752c3e7449901916a6.exe 79c3edfacbd61c56e01d49ed1e7d97ad47bbc425819ea2752c3e7449901916a6.exe PID 1376 wrote to memory of 3160 1376 79c3edfacbd61c56e01d49ed1e7d97ad47bbc425819ea2752c3e7449901916a6.exe 79c3edfacbd61c56e01d49ed1e7d97ad47bbc425819ea2752c3e7449901916a6.exe PID 1376 wrote to memory of 208 1376 79c3edfacbd61c56e01d49ed1e7d97ad47bbc425819ea2752c3e7449901916a6.exe 79c3edfacbd61c56e01d49ed1e7d97ad47bbc425819ea2752c3e7449901916a6.exe PID 1376 wrote to memory of 208 1376 79c3edfacbd61c56e01d49ed1e7d97ad47bbc425819ea2752c3e7449901916a6.exe 79c3edfacbd61c56e01d49ed1e7d97ad47bbc425819ea2752c3e7449901916a6.exe PID 1376 wrote to memory of 208 1376 79c3edfacbd61c56e01d49ed1e7d97ad47bbc425819ea2752c3e7449901916a6.exe 79c3edfacbd61c56e01d49ed1e7d97ad47bbc425819ea2752c3e7449901916a6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\79c3edfacbd61c56e01d49ed1e7d97ad47bbc425819ea2752c3e7449901916a6.exe"C:\Users\Admin\AppData\Local\Temp\79c3edfacbd61c56e01d49ed1e7d97ad47bbc425819ea2752c3e7449901916a6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\79c3edfacbd61c56e01d49ed1e7d97ad47bbc425819ea2752c3e7449901916a6.exestart2⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\79c3edfacbd61c56e01d49ed1e7d97ad47bbc425819ea2752c3e7449901916a6.exewatch2⤵PID:208