Analysis
-
max time kernel
243s -
max time network
256s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29/11/2022, 14:28
Static task
static1
Behavioral task
behavioral1
Sample
6e8589e3a53e27cfb36577b245d8751036d6df26a1399057b8ccdde35fa35bc3.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
6e8589e3a53e27cfb36577b245d8751036d6df26a1399057b8ccdde35fa35bc3.exe
Resource
win10v2004-20220812-en
General
-
Target
6e8589e3a53e27cfb36577b245d8751036d6df26a1399057b8ccdde35fa35bc3.exe
-
Size
28KB
-
MD5
8b71e83653e6a7cf75da50ab45af58a0
-
SHA1
e75f34bd92249f6b6874d8b9fc1397aa1b250f6b
-
SHA256
6e8589e3a53e27cfb36577b245d8751036d6df26a1399057b8ccdde35fa35bc3
-
SHA512
62e61e06611ae46b164991eaed77334a237f5f50fd602dd3dfa89ad1d0726f413b457fb88e9ab5c3ba44c03d39ec9c013ec018d359ce59abec00cdfdaf8368ee
-
SSDEEP
384:4mOyMLjKMPH1Dxw7ZA8l9ZoA7k+w9G5hmssR0IkR46nzojn8mgRRtssIeo/r5J1i:FUjKVjl9xw3x6nz7vj1wroB
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5008 6e8589e3a53e27cfb36577b245d8751036d6df26a1399057b8ccdde35fa35bc3.exe 5008 6e8589e3a53e27cfb36577b245d8751036d6df26a1399057b8ccdde35fa35bc3.exe 5008 6e8589e3a53e27cfb36577b245d8751036d6df26a1399057b8ccdde35fa35bc3.exe 5008 6e8589e3a53e27cfb36577b245d8751036d6df26a1399057b8ccdde35fa35bc3.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5008 wrote to memory of 376 5008 6e8589e3a53e27cfb36577b245d8751036d6df26a1399057b8ccdde35fa35bc3.exe 36 PID 5008 wrote to memory of 376 5008 6e8589e3a53e27cfb36577b245d8751036d6df26a1399057b8ccdde35fa35bc3.exe 36 PID 5008 wrote to memory of 376 5008 6e8589e3a53e27cfb36577b245d8751036d6df26a1399057b8ccdde35fa35bc3.exe 36 PID 5008 wrote to memory of 376 5008 6e8589e3a53e27cfb36577b245d8751036d6df26a1399057b8ccdde35fa35bc3.exe 36 PID 5008 wrote to memory of 376 5008 6e8589e3a53e27cfb36577b245d8751036d6df26a1399057b8ccdde35fa35bc3.exe 36 PID 5008 wrote to memory of 376 5008 6e8589e3a53e27cfb36577b245d8751036d6df26a1399057b8ccdde35fa35bc3.exe 36
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\6e8589e3a53e27cfb36577b245d8751036d6df26a1399057b8ccdde35fa35bc3.exe"C:\Users\Admin\AppData\Local\Temp\6e8589e3a53e27cfb36577b245d8751036d6df26a1399057b8ccdde35fa35bc3.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5008
-