Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 10:17
Static task
static1
Behavioral task
behavioral1
Sample
b0a0e9b1c861bdfcc77add49322d6b7def46dd9bee1b82ce8aed06441644ada0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b0a0e9b1c861bdfcc77add49322d6b7def46dd9bee1b82ce8aed06441644ada0.exe
Resource
win10v2004-20220812-en
General
-
Target
b0a0e9b1c861bdfcc77add49322d6b7def46dd9bee1b82ce8aed06441644ada0.exe
-
Size
39KB
-
MD5
116bdca934b7d661137b0278e33da640
-
SHA1
8bbc71faad9ab0e2c25e8af63f67ec2b23c620e7
-
SHA256
b0a0e9b1c861bdfcc77add49322d6b7def46dd9bee1b82ce8aed06441644ada0
-
SHA512
d25ef9af5443d18ef9c6595c5dcf0ed970ac58f63c5479813674453110d21c0920ec111b212c218071f37b97223074fd3f51725d457bdf0fd23fa623717cb44c
-
SSDEEP
768:7UfiwHghryEH/qs9be+7nyWXjmantS8YzXBmg:7Ufiw+r5C2be+NqYUFrsg
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2036 b0a0e9b1c861bdfcc77add49322d6b7def46dd9bee1b82ce8aed06441644ada0.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2036 wrote to memory of 1256 2036 b0a0e9b1c861bdfcc77add49322d6b7def46dd9bee1b82ce8aed06441644ada0.exe 13 PID 2036 wrote to memory of 1256 2036 b0a0e9b1c861bdfcc77add49322d6b7def46dd9bee1b82ce8aed06441644ada0.exe 13 PID 2036 wrote to memory of 1256 2036 b0a0e9b1c861bdfcc77add49322d6b7def46dd9bee1b82ce8aed06441644ada0.exe 13 PID 2036 wrote to memory of 1256 2036 b0a0e9b1c861bdfcc77add49322d6b7def46dd9bee1b82ce8aed06441644ada0.exe 13 PID 2036 wrote to memory of 1256 2036 b0a0e9b1c861bdfcc77add49322d6b7def46dd9bee1b82ce8aed06441644ada0.exe 13 PID 2036 wrote to memory of 1256 2036 b0a0e9b1c861bdfcc77add49322d6b7def46dd9bee1b82ce8aed06441644ada0.exe 13
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\b0a0e9b1c861bdfcc77add49322d6b7def46dd9bee1b82ce8aed06441644ada0.exe"C:\Users\Admin\AppData\Local\Temp\b0a0e9b1c861bdfcc77add49322d6b7def46dd9bee1b82ce8aed06441644ada0.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2036
-