Analysis
-
max time kernel
6s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 15:47
Static task
static1
Behavioral task
behavioral1
Sample
97065c55c3ba00a6a12250dd81b99d8d4c5519cc22f4fce4c5542ed9a7c6f289.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
97065c55c3ba00a6a12250dd81b99d8d4c5519cc22f4fce4c5542ed9a7c6f289.exe
Resource
win10v2004-20220812-en
General
-
Target
97065c55c3ba00a6a12250dd81b99d8d4c5519cc22f4fce4c5542ed9a7c6f289.exe
-
Size
48KB
-
MD5
290b5a3b9b1fa91bb044b9d4a7b4a48f
-
SHA1
90733385adba7583caf11fdd54295b4ec8da4719
-
SHA256
97065c55c3ba00a6a12250dd81b99d8d4c5519cc22f4fce4c5542ed9a7c6f289
-
SHA512
8e1e522955a6789ab286b08acefe2d7b9df97e086be21ea1aa2903190faa2d9a98842ff393b3cfaf2cb9727edb4dd4e669c0d0a46cf249360f2b75fb5f079f41
-
SSDEEP
768:4VzTAI319fmgDbTIpKd9als2OACyFmOxuJnwppCslGGnAJzih4tPED4G/uWD:yAufbTIAYOA9mOxvpp/A+AW42kG/uWD
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
97065c55c3ba00a6a12250dd81b99d8d4c5519cc22f4fce4c5542ed9a7c6f289.exepid process 1256 97065c55c3ba00a6a12250dd81b99d8d4c5519cc22f4fce4c5542ed9a7c6f289.exe 1256 97065c55c3ba00a6a12250dd81b99d8d4c5519cc22f4fce4c5542ed9a7c6f289.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
97065c55c3ba00a6a12250dd81b99d8d4c5519cc22f4fce4c5542ed9a7c6f289.exedescription pid process target process PID 1256 wrote to memory of 1212 1256 97065c55c3ba00a6a12250dd81b99d8d4c5519cc22f4fce4c5542ed9a7c6f289.exe Explorer.EXE PID 1256 wrote to memory of 1212 1256 97065c55c3ba00a6a12250dd81b99d8d4c5519cc22f4fce4c5542ed9a7c6f289.exe Explorer.EXE PID 1256 wrote to memory of 1212 1256 97065c55c3ba00a6a12250dd81b99d8d4c5519cc22f4fce4c5542ed9a7c6f289.exe Explorer.EXE PID 1256 wrote to memory of 1212 1256 97065c55c3ba00a6a12250dd81b99d8d4c5519cc22f4fce4c5542ed9a7c6f289.exe Explorer.EXE PID 1256 wrote to memory of 1212 1256 97065c55c3ba00a6a12250dd81b99d8d4c5519cc22f4fce4c5542ed9a7c6f289.exe Explorer.EXE PID 1256 wrote to memory of 1212 1256 97065c55c3ba00a6a12250dd81b99d8d4c5519cc22f4fce4c5542ed9a7c6f289.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\97065c55c3ba00a6a12250dd81b99d8d4c5519cc22f4fce4c5542ed9a7c6f289.exe"C:\Users\Admin\AppData\Local\Temp\97065c55c3ba00a6a12250dd81b99d8d4c5519cc22f4fce4c5542ed9a7c6f289.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1256