Analysis
-
max time kernel
109s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 09:30
Static task
static1
Behavioral task
behavioral1
Sample
5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe
Resource
win7-20220812-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe
-
Size
1018KB
-
MD5
edd15ba0e56002466371b1bc2f240c19
-
SHA1
ad7966d8ebc750c740921e621541c1c7434d1c9a
-
SHA256
5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d
-
SHA512
17f1c8f4632bcf29586cc80a1c4e406ed1548e2061451214de823f4aa7b0c7d1839b5430a84cd2d30a3fbcc0c68e5fdee526da7d682bede8929488fefe85579a
-
SSDEEP
6144:do3pwmXC25RIyX4db7SvNJnxPGpvSiyS:ddmy2X4d
Score
1/10
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.execmd.exedescription pid process target process PID 748 wrote to memory of 1712 748 5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe cmd.exe PID 748 wrote to memory of 1712 748 5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe cmd.exe PID 748 wrote to memory of 1712 748 5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe cmd.exe PID 1712 wrote to memory of 1572 1712 cmd.exe PING.EXE PID 1712 wrote to memory of 1572 1712 cmd.exe PING.EXE PID 1712 wrote to memory of 1572 1712 cmd.exe PING.EXE PID 1712 wrote to memory of 1452 1712 cmd.exe 5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe PID 1712 wrote to memory of 1452 1712 cmd.exe 5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe PID 1712 wrote to memory of 1452 1712 cmd.exe 5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe"C:\Users\Admin\AppData\Local\Temp\5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\system32\cmd.execmd /c ping 127.0.0.1 -n 8 & start "" "C:\Users\Admin\AppData\Local\Temp\5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe" his & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 83⤵
- Runs ping.exe
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe"C:\Users\Admin\AppData\Local\Temp\5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe" his3⤵PID:1452