Analysis
-
max time kernel
160s -
max time network
202s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 12:10
Static task
static1
Behavioral task
behavioral1
Sample
6980a42cdcb577919005616c2a7eb90914a052f281bd122f6cb252b52fe1ea5b.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6980a42cdcb577919005616c2a7eb90914a052f281bd122f6cb252b52fe1ea5b.exe
Resource
win10v2004-20221111-en
General
-
Target
6980a42cdcb577919005616c2a7eb90914a052f281bd122f6cb252b52fe1ea5b.exe
-
Size
518KB
-
MD5
f399c4f99bc05033fb427476f8d6eef0
-
SHA1
6418aee78c0d6c764fcaa82e378deab972c75b8b
-
SHA256
6980a42cdcb577919005616c2a7eb90914a052f281bd122f6cb252b52fe1ea5b
-
SHA512
0917b9e11a471d7b1b07e4b029749bbbda71921c918f66a990506f9d875c1bcb82c02d531a9628abcc8a364cdbe287dec5d65955e7e6a6ff41d47de352043a29
-
SSDEEP
6144:NhGDThjD8Y7O0gg01MtbLq+/zaNy6/yegQnhZWCmlw75G9+lLPX9MM8e459KOoWu:8TxBguBLq/1nZKwYYlLPt5oKnWq3ub
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
6980a42cdcb577919005616c2a7eb90914a052f281bd122f6cb252b52fe1ea5b.exedescription pid process target process PID 2300 wrote to memory of 2264 2300 6980a42cdcb577919005616c2a7eb90914a052f281bd122f6cb252b52fe1ea5b.exe 6980a42cdcb577919005616c2a7eb90914a052f281bd122f6cb252b52fe1ea5b.exe PID 2300 wrote to memory of 2264 2300 6980a42cdcb577919005616c2a7eb90914a052f281bd122f6cb252b52fe1ea5b.exe 6980a42cdcb577919005616c2a7eb90914a052f281bd122f6cb252b52fe1ea5b.exe PID 2300 wrote to memory of 2264 2300 6980a42cdcb577919005616c2a7eb90914a052f281bd122f6cb252b52fe1ea5b.exe 6980a42cdcb577919005616c2a7eb90914a052f281bd122f6cb252b52fe1ea5b.exe PID 2300 wrote to memory of 4540 2300 6980a42cdcb577919005616c2a7eb90914a052f281bd122f6cb252b52fe1ea5b.exe 6980a42cdcb577919005616c2a7eb90914a052f281bd122f6cb252b52fe1ea5b.exe PID 2300 wrote to memory of 4540 2300 6980a42cdcb577919005616c2a7eb90914a052f281bd122f6cb252b52fe1ea5b.exe 6980a42cdcb577919005616c2a7eb90914a052f281bd122f6cb252b52fe1ea5b.exe PID 2300 wrote to memory of 4540 2300 6980a42cdcb577919005616c2a7eb90914a052f281bd122f6cb252b52fe1ea5b.exe 6980a42cdcb577919005616c2a7eb90914a052f281bd122f6cb252b52fe1ea5b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6980a42cdcb577919005616c2a7eb90914a052f281bd122f6cb252b52fe1ea5b.exe"C:\Users\Admin\AppData\Local\Temp\6980a42cdcb577919005616c2a7eb90914a052f281bd122f6cb252b52fe1ea5b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\6980a42cdcb577919005616c2a7eb90914a052f281bd122f6cb252b52fe1ea5b.exestart2⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\6980a42cdcb577919005616c2a7eb90914a052f281bd122f6cb252b52fe1ea5b.exewatch2⤵PID:4540