Analysis
-
max time kernel
40s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 13:08
Static task
static1
Behavioral task
behavioral1
Sample
98407b2ba346b7f1fe439dae2f1dbccaab9b75b90b8f39560cd7427f3398ecfc.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
98407b2ba346b7f1fe439dae2f1dbccaab9b75b90b8f39560cd7427f3398ecfc.exe
Resource
win10v2004-20220812-en
General
-
Target
98407b2ba346b7f1fe439dae2f1dbccaab9b75b90b8f39560cd7427f3398ecfc.exe
-
Size
325KB
-
MD5
52582502d631e3dcce115c0ff0a9c0e5
-
SHA1
4db6700d50a352bc9347bdce84f84ad131763b10
-
SHA256
98407b2ba346b7f1fe439dae2f1dbccaab9b75b90b8f39560cd7427f3398ecfc
-
SHA512
f9c948fe13cc86653b36541cd9bc7427759fe9ec9ff708946bfa70bf82e039a0db835a96d70ae94f8f9e08f69c14004b0e675fed54f543de1695c4fca00ab67f
-
SSDEEP
6144:lnpAOgw8HYWO9Ket53wzrM3sYpc/uvxmxMW7jySMe3xNzIly22:lnpH4HYWO9KG9wZ0c/upmxZ7mUhKlz2
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1920 98407b2ba346b7f1fe439dae2f1dbccaab9b75b90b8f39560cd7427f3398ecfc.exe 1920 98407b2ba346b7f1fe439dae2f1dbccaab9b75b90b8f39560cd7427f3398ecfc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1920 wrote to memory of 1256 1920 98407b2ba346b7f1fe439dae2f1dbccaab9b75b90b8f39560cd7427f3398ecfc.exe 8 PID 1920 wrote to memory of 1256 1920 98407b2ba346b7f1fe439dae2f1dbccaab9b75b90b8f39560cd7427f3398ecfc.exe 8 PID 1920 wrote to memory of 1256 1920 98407b2ba346b7f1fe439dae2f1dbccaab9b75b90b8f39560cd7427f3398ecfc.exe 8 PID 1920 wrote to memory of 1256 1920 98407b2ba346b7f1fe439dae2f1dbccaab9b75b90b8f39560cd7427f3398ecfc.exe 8
Processes
-
C:\Users\Admin\AppData\Local\Temp\98407b2ba346b7f1fe439dae2f1dbccaab9b75b90b8f39560cd7427f3398ecfc.exe"C:\Users\Admin\AppData\Local\Temp\98407b2ba346b7f1fe439dae2f1dbccaab9b75b90b8f39560cd7427f3398ecfc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1920
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1256