Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 14:23
Static task
static1
Behavioral task
behavioral1
Sample
4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe
Resource
win10v2004-20220812-en
General
-
Target
4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe
-
Size
524KB
-
MD5
0e95ab36094c58260475753a3ec28962
-
SHA1
979b2b61f3a6a81b38597bf5a254da088454a81f
-
SHA256
4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060
-
SHA512
f777c7f39f298ca844f96d1a2e7f8dc713a17d2a95f4915459da0b51ea6318709cade382f7a52c7d33716d28ea8e5f2e9eec578a3d82e894c26deecd75337ceb
-
SSDEEP
12288:jhT4GF9oaKXhHGvndezzWv4bON/uL63PTb/g0OJp/obhS:Z46CXH4dtOy/uE/Qfw9S
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exedescription pid process target process PID 1736 wrote to memory of 952 1736 4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe 4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe PID 1736 wrote to memory of 952 1736 4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe 4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe PID 1736 wrote to memory of 952 1736 4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe 4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe PID 1736 wrote to memory of 952 1736 4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe 4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe PID 1736 wrote to memory of 952 1736 4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe 4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe PID 1736 wrote to memory of 952 1736 4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe 4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe PID 1736 wrote to memory of 952 1736 4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe 4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe PID 1736 wrote to memory of 1164 1736 4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe 4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe PID 1736 wrote to memory of 1164 1736 4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe 4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe PID 1736 wrote to memory of 1164 1736 4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe 4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe PID 1736 wrote to memory of 1164 1736 4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe 4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe PID 1736 wrote to memory of 1164 1736 4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe 4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe PID 1736 wrote to memory of 1164 1736 4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe 4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe PID 1736 wrote to memory of 1164 1736 4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe 4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe"C:\Users\Admin\AppData\Local\Temp\4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exestart2⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\4ae33d0b06608426c30c0257d4640940818e65ba29896c20fba3a68202f60060.exewatch2⤵PID:1164