Analysis
-
max time kernel
91s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 07:49
Static task
static1
Behavioral task
behavioral1
Sample
f685697d99a7e537d150b0dbdc7ff5612c01c651e05593621b519d917a43c057.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f685697d99a7e537d150b0dbdc7ff5612c01c651e05593621b519d917a43c057.exe
Resource
win10v2004-20220901-en
General
-
Target
f685697d99a7e537d150b0dbdc7ff5612c01c651e05593621b519d917a43c057.exe
-
Size
75KB
-
MD5
f2083bb3425385fca5c340e2f1e4bf3f
-
SHA1
5a627ba4f8710727f463a7792afe7b027cac7012
-
SHA256
f685697d99a7e537d150b0dbdc7ff5612c01c651e05593621b519d917a43c057
-
SHA512
6069c2a3bdb490852d1a8cd3df3621df359f42f14ac8d8e2adcf91377ca25bf1b906ee8cc5ba8804a733f319c74a011e8a9ce15ad69c7687cd31a9305f78ea56
-
SSDEEP
1536:vj8d0yHjiifOBqvUlEhHJadNEGm6DjIAJBV3L+lfDTw:vj8d0wiifO+hHJaDEGm6ooBkw
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1632 wrote to memory of 2696 1632 f685697d99a7e537d150b0dbdc7ff5612c01c651e05593621b519d917a43c057.exe 80 PID 1632 wrote to memory of 2696 1632 f685697d99a7e537d150b0dbdc7ff5612c01c651e05593621b519d917a43c057.exe 80 PID 1632 wrote to memory of 2696 1632 f685697d99a7e537d150b0dbdc7ff5612c01c651e05593621b519d917a43c057.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\f685697d99a7e537d150b0dbdc7ff5612c01c651e05593621b519d917a43c057.exe"C:\Users\Admin\AppData\Local\Temp\f685697d99a7e537d150b0dbdc7ff5612c01c651e05593621b519d917a43c057.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\f685697d99a7e537d150b0dbdc7ff5612c01c651e05593621b519d917a43c057.exe?2⤵PID:2696
-