Analysis
-
max time kernel
167s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2022 01:47
Static task
static1
Behavioral task
behavioral1
Sample
8a7775a01e2d1bce48aa7c6d5ebd179e1e031aaba058ea26abfd6a67d9ab6ded.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8a7775a01e2d1bce48aa7c6d5ebd179e1e031aaba058ea26abfd6a67d9ab6ded.exe
Resource
win10v2004-20220812-en
General
-
Target
8a7775a01e2d1bce48aa7c6d5ebd179e1e031aaba058ea26abfd6a67d9ab6ded.exe
-
Size
63KB
-
MD5
4d36bf55664954d69fd976ad3ce033dd
-
SHA1
16b58453fdd018f62b6231e5fc5142f3a47b5fcf
-
SHA256
8a7775a01e2d1bce48aa7c6d5ebd179e1e031aaba058ea26abfd6a67d9ab6ded
-
SHA512
14b5d75422f64ab0523eeb5a755c56bf5259371ab3f02d7dc07481997a6983b2c8736d9a2cc37b9b6018239ff395b121ddb4ae448130fd0a2b55d56e846250eb
-
SSDEEP
1536:Nv3qjj4xxCqR8xxCMqP0ZZgxL8Xwj1sXLolsRuEU:NSjjIxCjcMqsZZZ4GLolsIE
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 636 wrote to memory of 4876 636 8a7775a01e2d1bce48aa7c6d5ebd179e1e031aaba058ea26abfd6a67d9ab6ded.exe 79 PID 636 wrote to memory of 4876 636 8a7775a01e2d1bce48aa7c6d5ebd179e1e031aaba058ea26abfd6a67d9ab6ded.exe 79 PID 636 wrote to memory of 4876 636 8a7775a01e2d1bce48aa7c6d5ebd179e1e031aaba058ea26abfd6a67d9ab6ded.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a7775a01e2d1bce48aa7c6d5ebd179e1e031aaba058ea26abfd6a67d9ab6ded.exe"C:\Users\Admin\AppData\Local\Temp\8a7775a01e2d1bce48aa7c6d5ebd179e1e031aaba058ea26abfd6a67d9ab6ded.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\8a7775a01e2d1bce48aa7c6d5ebd179e1e031aaba058ea26abfd6a67d9ab6ded.exeC:\Users\Admin\AppData\Local\Temp\8a7775a01e2d1bce4" 482⤵PID:4876
-