Analysis
-
max time kernel
41s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 14:25
Static task
static1
Behavioral task
behavioral1
Sample
80096a8c677b0299fd3247455bf8a85f0a1be3a8cae8e9e697df68276f26afaa.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
80096a8c677b0299fd3247455bf8a85f0a1be3a8cae8e9e697df68276f26afaa.exe
Resource
win10v2004-20221111-en
General
-
Target
80096a8c677b0299fd3247455bf8a85f0a1be3a8cae8e9e697df68276f26afaa.exe
-
Size
176KB
-
MD5
1da6ed22df32c14d4ead9b8c54a9480a
-
SHA1
ed52fe41e18fbf249903eec4403bc0852043381d
-
SHA256
80096a8c677b0299fd3247455bf8a85f0a1be3a8cae8e9e697df68276f26afaa
-
SHA512
db339c1299c6d5a883fbe508b828e71b04c960ce7494f0e79ff30da344d3b270852401860e3ae5d927c499442ff9070a656e26c1b8156769eb2e41a3f134b1ef
-
SSDEEP
3072:d2bnu8pFCYLZIshN4bStQfKIcbtwPQvSJPIPmUDHoPl+ZKwnI/CJ:dPQCY5hN4bDfMbtvsz22cK0FJ
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1688 80096a8c677b0299fd3247455bf8a85f0a1be3a8cae8e9e697df68276f26afaa.exe 1688 80096a8c677b0299fd3247455bf8a85f0a1be3a8cae8e9e697df68276f26afaa.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1688 wrote to memory of 1212 1688 80096a8c677b0299fd3247455bf8a85f0a1be3a8cae8e9e697df68276f26afaa.exe 13 PID 1688 wrote to memory of 1212 1688 80096a8c677b0299fd3247455bf8a85f0a1be3a8cae8e9e697df68276f26afaa.exe 13 PID 1688 wrote to memory of 1212 1688 80096a8c677b0299fd3247455bf8a85f0a1be3a8cae8e9e697df68276f26afaa.exe 13 PID 1688 wrote to memory of 1212 1688 80096a8c677b0299fd3247455bf8a85f0a1be3a8cae8e9e697df68276f26afaa.exe 13
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\80096a8c677b0299fd3247455bf8a85f0a1be3a8cae8e9e697df68276f26afaa.exe"C:\Users\Admin\AppData\Local\Temp\80096a8c677b0299fd3247455bf8a85f0a1be3a8cae8e9e697df68276f26afaa.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1688
-