Analysis
-
max time kernel
31s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 17:32
Static task
static1
Behavioral task
behavioral1
Sample
a7240ee637a60a40d552c015f173525277f3e2dfe72b72212f2e1c1b05eab258.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a7240ee637a60a40d552c015f173525277f3e2dfe72b72212f2e1c1b05eab258.exe
Resource
win10v2004-20220812-en
General
-
Target
a7240ee637a60a40d552c015f173525277f3e2dfe72b72212f2e1c1b05eab258.exe
-
Size
201KB
-
MD5
8b790905aa6ad3d3052ee3bf82dd788e
-
SHA1
3ca415f0a15afcd45d5cb601e13ff681dce24f1c
-
SHA256
a7240ee637a60a40d552c015f173525277f3e2dfe72b72212f2e1c1b05eab258
-
SHA512
10ab4f8cf903303de6be1496ac74d7099a6c72e8d222998168324c591787ade9d5cd53832505ae3380ee3f03a839b852483c992be47f699d27d9736ba60670c6
-
SSDEEP
3072:GNKJQazM+7Y4BriluiuYw1y0ss6n1O7WnXi2+PoabCJeBUrp:GNKJ6+7YEr2uYCypTk7WVabuemN
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1460 a7240ee637a60a40d552c015f173525277f3e2dfe72b72212f2e1c1b05eab258.exe 1460 a7240ee637a60a40d552c015f173525277f3e2dfe72b72212f2e1c1b05eab258.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1460 wrote to memory of 1340 1460 a7240ee637a60a40d552c015f173525277f3e2dfe72b72212f2e1c1b05eab258.exe 13 PID 1460 wrote to memory of 1340 1460 a7240ee637a60a40d552c015f173525277f3e2dfe72b72212f2e1c1b05eab258.exe 13 PID 1460 wrote to memory of 1340 1460 a7240ee637a60a40d552c015f173525277f3e2dfe72b72212f2e1c1b05eab258.exe 13 PID 1460 wrote to memory of 1340 1460 a7240ee637a60a40d552c015f173525277f3e2dfe72b72212f2e1c1b05eab258.exe 13
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\a7240ee637a60a40d552c015f173525277f3e2dfe72b72212f2e1c1b05eab258.exe"C:\Users\Admin\AppData\Local\Temp\a7240ee637a60a40d552c015f173525277f3e2dfe72b72212f2e1c1b05eab258.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1460
-