Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 06:58
Static task
static1
Behavioral task
behavioral1
Sample
da4a54c02f81063e3b9b6ac7f45ce687f8a8db2ba507e8698fa87f42bfbdd38d.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
da4a54c02f81063e3b9b6ac7f45ce687f8a8db2ba507e8698fa87f42bfbdd38d.exe
Resource
win10v2004-20221111-en
General
-
Target
da4a54c02f81063e3b9b6ac7f45ce687f8a8db2ba507e8698fa87f42bfbdd38d.exe
-
Size
56KB
-
MD5
485b0830be6c981d7430964aa6f32414
-
SHA1
b1ff6623419da327960498ccc23e87f95ee1291d
-
SHA256
da4a54c02f81063e3b9b6ac7f45ce687f8a8db2ba507e8698fa87f42bfbdd38d
-
SHA512
ee7ef1cd3a5d9451ee90e8083c0c20c16c3094f14d734c7170151ed0d47eea290a529ce788bf663d199863030d63a22bb1e306f4a6f89094c203c81e7226de8c
-
SSDEEP
1536:hS7W3X1qCqc8zCbf5O5z4YmMhx5Nb2UavVTskg:hHqC0UA4Y9Nb2U8W
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
da4a54c02f81063e3b9b6ac7f45ce687f8a8db2ba507e8698fa87f42bfbdd38d.exedescription pid process target process PID 2024 wrote to memory of 988 2024 da4a54c02f81063e3b9b6ac7f45ce687f8a8db2ba507e8698fa87f42bfbdd38d.exe da4a54c02f81063e3b9b6ac7f45ce687f8a8db2ba507e8698fa87f42bfbdd38d.exe PID 2024 wrote to memory of 988 2024 da4a54c02f81063e3b9b6ac7f45ce687f8a8db2ba507e8698fa87f42bfbdd38d.exe da4a54c02f81063e3b9b6ac7f45ce687f8a8db2ba507e8698fa87f42bfbdd38d.exe PID 2024 wrote to memory of 988 2024 da4a54c02f81063e3b9b6ac7f45ce687f8a8db2ba507e8698fa87f42bfbdd38d.exe da4a54c02f81063e3b9b6ac7f45ce687f8a8db2ba507e8698fa87f42bfbdd38d.exe PID 2024 wrote to memory of 988 2024 da4a54c02f81063e3b9b6ac7f45ce687f8a8db2ba507e8698fa87f42bfbdd38d.exe da4a54c02f81063e3b9b6ac7f45ce687f8a8db2ba507e8698fa87f42bfbdd38d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\da4a54c02f81063e3b9b6ac7f45ce687f8a8db2ba507e8698fa87f42bfbdd38d.exe"C:\Users\Admin\AppData\Local\Temp\da4a54c02f81063e3b9b6ac7f45ce687f8a8db2ba507e8698fa87f42bfbdd38d.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\da4a54c02f81063e3b9b6ac7f45ce687f8a8db2ba507e8698fa87f42bfbdd38d.exeC:\Users\Admin\AppData\Local\Temp\da4a54c02f81063e3" 482⤵