Analysis
-
max time kernel
155s -
max time network
198s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 16:41
Static task
static1
Behavioral task
behavioral1
Sample
9a845bc6a83b4a3cf9bd5cf518886dcad231e703f1a1726200ff3639efc4d96f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
9a845bc6a83b4a3cf9bd5cf518886dcad231e703f1a1726200ff3639efc4d96f.exe
Resource
win10v2004-20221111-en
General
-
Target
9a845bc6a83b4a3cf9bd5cf518886dcad231e703f1a1726200ff3639efc4d96f.exe
-
Size
143KB
-
MD5
22017b4dec570ed0ea730b42ec9f8cb8
-
SHA1
2cf2b91003d635fd2a8ae2043577d13569f03e7a
-
SHA256
9a845bc6a83b4a3cf9bd5cf518886dcad231e703f1a1726200ff3639efc4d96f
-
SHA512
1e88134b03111acd7746d14a7ae471fc8a8edea4149be868f81b3a6f55c63f9a0b1eb80f074f52368dcf46afe72e46ec2c734ae801c81ca25b8b436ac40406e9
-
SSDEEP
1536:0y+3HBAcxVp8ViTHmVTxhHNfmB1Dhn6gUBFp0bQbBgBaprxIN8YhNFE/1CO23o3/:0ymBAW5mVSnKp0kbqBaFxIq0Gi3w/
Malware Config
Signatures
-
Suspicious use of UnmapMainImage 1 IoCs
pid Process 4156 9a845bc6a83b4a3cf9bd5cf518886dcad231e703f1a1726200ff3639efc4d96f.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4156 wrote to memory of 1632 4156 9a845bc6a83b4a3cf9bd5cf518886dcad231e703f1a1726200ff3639efc4d96f.exe 81 PID 4156 wrote to memory of 1632 4156 9a845bc6a83b4a3cf9bd5cf518886dcad231e703f1a1726200ff3639efc4d96f.exe 81 PID 4156 wrote to memory of 1632 4156 9a845bc6a83b4a3cf9bd5cf518886dcad231e703f1a1726200ff3639efc4d96f.exe 81 PID 4156 wrote to memory of 1632 4156 9a845bc6a83b4a3cf9bd5cf518886dcad231e703f1a1726200ff3639efc4d96f.exe 81 PID 4156 wrote to memory of 1632 4156 9a845bc6a83b4a3cf9bd5cf518886dcad231e703f1a1726200ff3639efc4d96f.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a845bc6a83b4a3cf9bd5cf518886dcad231e703f1a1726200ff3639efc4d96f.exe"C:\Users\Admin\AppData\Local\Temp\9a845bc6a83b4a3cf9bd5cf518886dcad231e703f1a1726200ff3639efc4d96f.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵PID:1632
-