Analysis
-
max time kernel
150s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 14:41
Static task
static1
Behavioral task
behavioral1
Sample
2e2552f70f3d063b9fbfd1d9f5fbec93205cbd4d62caf7ccf500009fb4a53e7f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2e2552f70f3d063b9fbfd1d9f5fbec93205cbd4d62caf7ccf500009fb4a53e7f.exe
Resource
win10v2004-20221111-en
General
-
Target
2e2552f70f3d063b9fbfd1d9f5fbec93205cbd4d62caf7ccf500009fb4a53e7f.exe
-
Size
529KB
-
MD5
b1b4775e76effbde119ff13ec7550781
-
SHA1
ae74a17bb64c24f25fec6dde1fe2bae5ae7a1d24
-
SHA256
2e2552f70f3d063b9fbfd1d9f5fbec93205cbd4d62caf7ccf500009fb4a53e7f
-
SHA512
60017e680801d241eec5a08a6913aed2756937dbd14b54d28ad10a09ac5efbe97f5c7a687ad83251570f9634b974d8b0f31c2c320191f8067cd397e39642b1c1
-
SSDEEP
12288:WnrL99gDCXPTe2EdMwTVjRJ49dFgaKfHIbvwUO:eXPTe2iV1S9dcfH2vwB
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
2e2552f70f3d063b9fbfd1d9f5fbec93205cbd4d62caf7ccf500009fb4a53e7f.exedescription pid process target process PID 2124 wrote to memory of 1540 2124 2e2552f70f3d063b9fbfd1d9f5fbec93205cbd4d62caf7ccf500009fb4a53e7f.exe 2e2552f70f3d063b9fbfd1d9f5fbec93205cbd4d62caf7ccf500009fb4a53e7f.exe PID 2124 wrote to memory of 1540 2124 2e2552f70f3d063b9fbfd1d9f5fbec93205cbd4d62caf7ccf500009fb4a53e7f.exe 2e2552f70f3d063b9fbfd1d9f5fbec93205cbd4d62caf7ccf500009fb4a53e7f.exe PID 2124 wrote to memory of 1540 2124 2e2552f70f3d063b9fbfd1d9f5fbec93205cbd4d62caf7ccf500009fb4a53e7f.exe 2e2552f70f3d063b9fbfd1d9f5fbec93205cbd4d62caf7ccf500009fb4a53e7f.exe PID 2124 wrote to memory of 1616 2124 2e2552f70f3d063b9fbfd1d9f5fbec93205cbd4d62caf7ccf500009fb4a53e7f.exe 2e2552f70f3d063b9fbfd1d9f5fbec93205cbd4d62caf7ccf500009fb4a53e7f.exe PID 2124 wrote to memory of 1616 2124 2e2552f70f3d063b9fbfd1d9f5fbec93205cbd4d62caf7ccf500009fb4a53e7f.exe 2e2552f70f3d063b9fbfd1d9f5fbec93205cbd4d62caf7ccf500009fb4a53e7f.exe PID 2124 wrote to memory of 1616 2124 2e2552f70f3d063b9fbfd1d9f5fbec93205cbd4d62caf7ccf500009fb4a53e7f.exe 2e2552f70f3d063b9fbfd1d9f5fbec93205cbd4d62caf7ccf500009fb4a53e7f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e2552f70f3d063b9fbfd1d9f5fbec93205cbd4d62caf7ccf500009fb4a53e7f.exe"C:\Users\Admin\AppData\Local\Temp\2e2552f70f3d063b9fbfd1d9f5fbec93205cbd4d62caf7ccf500009fb4a53e7f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\2e2552f70f3d063b9fbfd1d9f5fbec93205cbd4d62caf7ccf500009fb4a53e7f.exestart2⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\2e2552f70f3d063b9fbfd1d9f5fbec93205cbd4d62caf7ccf500009fb4a53e7f.exewatch2⤵PID:1616