Analysis
-
max time kernel
45s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
24/11/2022, 03:10
Static task
static1
Behavioral task
behavioral1
Sample
54755ea17909028d0844659feaa283251fa2be0f77ac0b694b229352ca8df449.exe
Resource
win7-20220901-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
54755ea17909028d0844659feaa283251fa2be0f77ac0b694b229352ca8df449.exe
Resource
win10v2004-20221111-en
1 signatures
150 seconds
General
-
Target
54755ea17909028d0844659feaa283251fa2be0f77ac0b694b229352ca8df449.exe
-
Size
484KB
-
MD5
3dd422d11f1eaab1343bc9d5f46c249e
-
SHA1
d46cc4d813a81e2d8da25e57dd2288c03e74df5e
-
SHA256
54755ea17909028d0844659feaa283251fa2be0f77ac0b694b229352ca8df449
-
SHA512
639716e136671fa2db878f9202c72344a2c3b363f0e73daa4b4ede51b6ba776211d2defa3cf3be04ef78a8dfe886c1b8ea133e2061e9abd9b872205e4a21d6ee
-
SSDEEP
12288:GKDtqVs7SIURn5/bStJWyti/nWWaPycSy6CK:vqVTx2yAAnOatyk
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1340 wrote to memory of 1752 1340 54755ea17909028d0844659feaa283251fa2be0f77ac0b694b229352ca8df449.exe 27 PID 1340 wrote to memory of 1752 1340 54755ea17909028d0844659feaa283251fa2be0f77ac0b694b229352ca8df449.exe 27 PID 1340 wrote to memory of 1752 1340 54755ea17909028d0844659feaa283251fa2be0f77ac0b694b229352ca8df449.exe 27 PID 1340 wrote to memory of 1752 1340 54755ea17909028d0844659feaa283251fa2be0f77ac0b694b229352ca8df449.exe 27 PID 1340 wrote to memory of 1120 1340 54755ea17909028d0844659feaa283251fa2be0f77ac0b694b229352ca8df449.exe 28 PID 1340 wrote to memory of 1120 1340 54755ea17909028d0844659feaa283251fa2be0f77ac0b694b229352ca8df449.exe 28 PID 1340 wrote to memory of 1120 1340 54755ea17909028d0844659feaa283251fa2be0f77ac0b694b229352ca8df449.exe 28 PID 1340 wrote to memory of 1120 1340 54755ea17909028d0844659feaa283251fa2be0f77ac0b694b229352ca8df449.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\54755ea17909028d0844659feaa283251fa2be0f77ac0b694b229352ca8df449.exe"C:\Users\Admin\AppData\Local\Temp\54755ea17909028d0844659feaa283251fa2be0f77ac0b694b229352ca8df449.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\54755ea17909028d0844659feaa283251fa2be0f77ac0b694b229352ca8df449.exestart2⤵PID:1752
-
-
C:\Users\Admin\AppData\Local\Temp\54755ea17909028d0844659feaa283251fa2be0f77ac0b694b229352ca8df449.exewatch2⤵PID:1120
-