Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 09:54
Static task
static1
Behavioral task
behavioral1
Sample
77c49b0553eb4b87bbe67589c793118b0082d6ab1df3905cb7fbb158c7114434.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
77c49b0553eb4b87bbe67589c793118b0082d6ab1df3905cb7fbb158c7114434.exe
Resource
win10v2004-20220812-en
General
-
Target
77c49b0553eb4b87bbe67589c793118b0082d6ab1df3905cb7fbb158c7114434.exe
-
Size
311KB
-
MD5
6dfa5c08b879879186aaa0e9b957e94e
-
SHA1
7e13d4acb962ef32cac28a112bcaca13ba18aba2
-
SHA256
77c49b0553eb4b87bbe67589c793118b0082d6ab1df3905cb7fbb158c7114434
-
SHA512
ff5559aabf2c8d509fb4f416bbe61b0c80693473b9a794e107e8de75057add39e3ce8e326a29d04c1d4e25ae2c5252c1ba97888bbfa42919e1f40034caf63f7c
-
SSDEEP
6144:qYLUIm4OetWX1zfmAPpp2eJFW2vfcRC6hI1UiWK05mtHBZN1jT:/zOe4eKW2sv+0YtFZ
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4248 set thread context of 1048 4248 77c49b0553eb4b87bbe67589c793118b0082d6ab1df3905cb7fbb158c7114434.exe 81 -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4248 wrote to memory of 1048 4248 77c49b0553eb4b87bbe67589c793118b0082d6ab1df3905cb7fbb158c7114434.exe 81 PID 4248 wrote to memory of 1048 4248 77c49b0553eb4b87bbe67589c793118b0082d6ab1df3905cb7fbb158c7114434.exe 81 PID 4248 wrote to memory of 1048 4248 77c49b0553eb4b87bbe67589c793118b0082d6ab1df3905cb7fbb158c7114434.exe 81 PID 4248 wrote to memory of 1048 4248 77c49b0553eb4b87bbe67589c793118b0082d6ab1df3905cb7fbb158c7114434.exe 81 PID 4248 wrote to memory of 1048 4248 77c49b0553eb4b87bbe67589c793118b0082d6ab1df3905cb7fbb158c7114434.exe 81 PID 4248 wrote to memory of 1048 4248 77c49b0553eb4b87bbe67589c793118b0082d6ab1df3905cb7fbb158c7114434.exe 81 PID 4248 wrote to memory of 1048 4248 77c49b0553eb4b87bbe67589c793118b0082d6ab1df3905cb7fbb158c7114434.exe 81 PID 4248 wrote to memory of 1048 4248 77c49b0553eb4b87bbe67589c793118b0082d6ab1df3905cb7fbb158c7114434.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\77c49b0553eb4b87bbe67589c793118b0082d6ab1df3905cb7fbb158c7114434.exe"C:\Users\Admin\AppData\Local\Temp\77c49b0553eb4b87bbe67589c793118b0082d6ab1df3905cb7fbb158c7114434.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\77c49b0553eb4b87bbe67589c793118b0082d6ab1df3905cb7fbb158c7114434.exe"C:\Users\Admin\AppData\Local\Temp\77c49b0553eb4b87bbe67589c793118b0082d6ab1df3905cb7fbb158c7114434.exe"2⤵PID:1048
-