Analysis
-
max time kernel
62s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 15:46
Static task
static1
Behavioral task
behavioral1
Sample
6691a61f6dad9a10618d7f0b0655b7d500c0870a39558654e4a41f3f3bcfb1d8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6691a61f6dad9a10618d7f0b0655b7d500c0870a39558654e4a41f3f3bcfb1d8.exe
Resource
win10v2004-20220901-en
General
-
Target
6691a61f6dad9a10618d7f0b0655b7d500c0870a39558654e4a41f3f3bcfb1d8.exe
-
Size
29KB
-
MD5
ae63b3af3302bb1352e6bad55f7443f7
-
SHA1
9ab7f53332b1adbbfe251706d7e8698d4719997d
-
SHA256
6691a61f6dad9a10618d7f0b0655b7d500c0870a39558654e4a41f3f3bcfb1d8
-
SHA512
3ff1f393b81b8efec933779b6c266995dacb5ad0157a2ab7b81fe4bdf7306a08193312f2e650a91cf4b105d49527ef412a5463243ace24417162cb657e89ceef
-
SSDEEP
768:geLMhlzjRKiQWgdgmWhtaHxNZbR3Xe9lZ3FD:1AzjRpngfsaHv3eJx
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
6691a61f6dad9a10618d7f0b0655b7d500c0870a39558654e4a41f3f3bcfb1d8.exepid process 3704 6691a61f6dad9a10618d7f0b0655b7d500c0870a39558654e4a41f3f3bcfb1d8.exe 3704 6691a61f6dad9a10618d7f0b0655b7d500c0870a39558654e4a41f3f3bcfb1d8.exe 3704 6691a61f6dad9a10618d7f0b0655b7d500c0870a39558654e4a41f3f3bcfb1d8.exe 3704 6691a61f6dad9a10618d7f0b0655b7d500c0870a39558654e4a41f3f3bcfb1d8.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
6691a61f6dad9a10618d7f0b0655b7d500c0870a39558654e4a41f3f3bcfb1d8.exedescription pid process target process PID 3704 wrote to memory of 2440 3704 6691a61f6dad9a10618d7f0b0655b7d500c0870a39558654e4a41f3f3bcfb1d8.exe Explorer.EXE PID 3704 wrote to memory of 2440 3704 6691a61f6dad9a10618d7f0b0655b7d500c0870a39558654e4a41f3f3bcfb1d8.exe Explorer.EXE PID 3704 wrote to memory of 2440 3704 6691a61f6dad9a10618d7f0b0655b7d500c0870a39558654e4a41f3f3bcfb1d8.exe Explorer.EXE PID 3704 wrote to memory of 2440 3704 6691a61f6dad9a10618d7f0b0655b7d500c0870a39558654e4a41f3f3bcfb1d8.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\6691a61f6dad9a10618d7f0b0655b7d500c0870a39558654e4a41f3f3bcfb1d8.exe"C:\Users\Admin\AppData\Local\Temp\6691a61f6dad9a10618d7f0b0655b7d500c0870a39558654e4a41f3f3bcfb1d8.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3704