Analysis
-
max time kernel
85s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 17:25
Static task
static1
Behavioral task
behavioral1
Sample
e6dbc604d49eb8f79a8056d808829d076cf114dddd203cc90b407760d8f3c90b.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e6dbc604d49eb8f79a8056d808829d076cf114dddd203cc90b407760d8f3c90b.exe
Resource
win10v2004-20220901-en
General
-
Target
e6dbc604d49eb8f79a8056d808829d076cf114dddd203cc90b407760d8f3c90b.exe
-
Size
164KB
-
MD5
3a86dc89dc0c1f698d7543e7641bdbdc
-
SHA1
d65cd81ed2749fa8548cd07c1e8b70794f24406d
-
SHA256
e6dbc604d49eb8f79a8056d808829d076cf114dddd203cc90b407760d8f3c90b
-
SHA512
b0a60ef88795495fef463abf04bfe29e1bd0567e31e09ea037e0b79fdf59fd5694e4058281bbf3cd94a4af808643b6fd450073a8cd029367239dcd4d669eec7c
-
SSDEEP
3072:Uxk2qwZ4TNrhFfI+UHHGBXfd0bgMwuwHjjfOkLUROYdW1sOnuI/K4h9ZQGgJP97h:gk1NTt/vagMwuWjfOkLkOIW1x48gl9F
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1836 e6dbc604d49eb8f79a8056d808829d076cf114dddd203cc90b407760d8f3c90b.exe 1836 e6dbc604d49eb8f79a8056d808829d076cf114dddd203cc90b407760d8f3c90b.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1836 wrote to memory of 1192 1836 e6dbc604d49eb8f79a8056d808829d076cf114dddd203cc90b407760d8f3c90b.exe 14 PID 1836 wrote to memory of 1192 1836 e6dbc604d49eb8f79a8056d808829d076cf114dddd203cc90b407760d8f3c90b.exe 14 PID 1836 wrote to memory of 1192 1836 e6dbc604d49eb8f79a8056d808829d076cf114dddd203cc90b407760d8f3c90b.exe 14 PID 1836 wrote to memory of 1192 1836 e6dbc604d49eb8f79a8056d808829d076cf114dddd203cc90b407760d8f3c90b.exe 14
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\e6dbc604d49eb8f79a8056d808829d076cf114dddd203cc90b407760d8f3c90b.exe"C:\Users\Admin\AppData\Local\Temp\e6dbc604d49eb8f79a8056d808829d076cf114dddd203cc90b407760d8f3c90b.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1836
-