Analysis
-
max time kernel
33s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 11:15
Static task
static1
Behavioral task
behavioral1
Sample
18175bc1f3a7984661c31fe2f15a4560f00014c4ba5eda7e6c1cd14c8f5f579d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
18175bc1f3a7984661c31fe2f15a4560f00014c4ba5eda7e6c1cd14c8f5f579d.exe
Resource
win10v2004-20220901-en
General
-
Target
18175bc1f3a7984661c31fe2f15a4560f00014c4ba5eda7e6c1cd14c8f5f579d.exe
-
Size
178KB
-
MD5
29756253923bedb066b4754e8ac76c46
-
SHA1
48779bf44621ae869d4fa273bce2f579498f9554
-
SHA256
18175bc1f3a7984661c31fe2f15a4560f00014c4ba5eda7e6c1cd14c8f5f579d
-
SHA512
11e1437b694dc565c36ff566163c8814a1db3ab70399022fe922d328020e68d22cd259097a956a063df2568762f8e26d1a53758a90cf5fe6ecc8a0e8ba627781
-
SSDEEP
3072:Ptn44KzldJMLrivtwFoUaOBgjaN+KKIRnz83dmpPNa8BSVdKO4GeXI89CcYg0IUK:F44KzlAi1YoUlBEsvRqdmpPFjt9DiIpR
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
18175bc1f3a7984661c31fe2f15a4560f00014c4ba5eda7e6c1cd14c8f5f579d.exepid process 1224 18175bc1f3a7984661c31fe2f15a4560f00014c4ba5eda7e6c1cd14c8f5f579d.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
18175bc1f3a7984661c31fe2f15a4560f00014c4ba5eda7e6c1cd14c8f5f579d.exepid process 1224 18175bc1f3a7984661c31fe2f15a4560f00014c4ba5eda7e6c1cd14c8f5f579d.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
18175bc1f3a7984661c31fe2f15a4560f00014c4ba5eda7e6c1cd14c8f5f579d.exedescription pid process target process PID 1224 wrote to memory of 1232 1224 18175bc1f3a7984661c31fe2f15a4560f00014c4ba5eda7e6c1cd14c8f5f579d.exe Explorer.EXE PID 1224 wrote to memory of 1232 1224 18175bc1f3a7984661c31fe2f15a4560f00014c4ba5eda7e6c1cd14c8f5f579d.exe Explorer.EXE PID 1224 wrote to memory of 1232 1224 18175bc1f3a7984661c31fe2f15a4560f00014c4ba5eda7e6c1cd14c8f5f579d.exe Explorer.EXE PID 1224 wrote to memory of 1232 1224 18175bc1f3a7984661c31fe2f15a4560f00014c4ba5eda7e6c1cd14c8f5f579d.exe Explorer.EXE PID 1224 wrote to memory of 1232 1224 18175bc1f3a7984661c31fe2f15a4560f00014c4ba5eda7e6c1cd14c8f5f579d.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\18175bc1f3a7984661c31fe2f15a4560f00014c4ba5eda7e6c1cd14c8f5f579d.exe"C:\Users\Admin\AppData\Local\Temp\18175bc1f3a7984661c31fe2f15a4560f00014c4ba5eda7e6c1cd14c8f5f579d.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1224