Analysis
- max time kernel
170s - max time network
196s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
01/12/2022, 22:04
Static task
static1
Behavioral task
behavioral1
Sample
83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe
Resource
win7-20221111-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe
- Size 40KB
- Sample221201-1y8e4afa22
- SHA256 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d
- MD5 def5106a7894cd34dda668546b1fc05e
- SHA1 91fc23227538b513de34b194c9b664734498d6ce
- SHA512 edb52fbbde46e979fe38c3c6b4f4db86aa358b3caad9e977af0866ef60fef6169e3828c51be7462ad7becaab54450cdccb183ae96b26277adffc6c4be62fa442
- SSDEEP 768:90SfbvHcTcFlTz+Mz+Fgljd0DEufTRxvT:i+zHcTalTzHz/lBx6NxL
- MD5 SHA1 SHA512 SSDEEP
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3856 set thread context of 4988 3856 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 82 - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3856 wrote to memory of 4988 3856 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 82 PID 3856 wrote to memory of 4988 3856 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 82 PID 3856 wrote to memory of 4988 3856 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 82 PID 3856 wrote to memory of 4988 3856 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 82 PID 3856 wrote to memory of 4988 3856 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 82 PID 3856 wrote to memory of 4988 3856 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 82 PID 3856 wrote to memory of 4988 3856 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 82 PID 3856 wrote to memory of 4988 3856 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 82 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62 PID 4988 wrote to memory of 2620 4988 83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe 62
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe"C:\Users\Admin\AppData\Local\Temp\83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\83da5ca41996c3b851cbb86855140d3b77eb5eef512dff85a04072a60fee7e8d.exe䌢尺獕牥屳摁業屮灁䑰瑡屡潌慣屬敔灭㡜搳㕡慣ㄴ㤹挶戳㔸挱扢㘸㔸ㄵ〴㍤㝢攷㕢敥㕦㈱晤㡦愵㐰㜰愲〶敦㝥㡥硥≥3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4988
-
-