Analysis
-
max time kernel
199s -
max time network
207s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 14:39
Static task
static1
Behavioral task
behavioral1
Sample
c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe
-
Size
73KB
-
MD5
36fc00259d6bd7b91db9b238009c1c6c
-
SHA1
5c4356994087375c3c0a4c020e728bee30272e19
-
SHA256
c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4
-
SHA512
a2f29a22bd51dc5d102ec34a66cbf4d475c1004a028e8dea56d3b608fb934483492ca48ad569a5b0ed7b9c131024e2fe9a14f319f618db48d124715fb3a7392f
-
SSDEEP
1536:wCTI3+TqSsoTRcEs+YPFkgmmfAPrUgMWWOfdMNJW:NTInoF0+6Fkg9fErUg5fSNJW
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4076 set thread context of 1804 4076 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 82 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4076 wrote to memory of 1804 4076 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 82 PID 4076 wrote to memory of 1804 4076 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 82 PID 4076 wrote to memory of 1804 4076 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 82 PID 4076 wrote to memory of 1804 4076 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 82 PID 4076 wrote to memory of 1804 4076 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 82 PID 4076 wrote to memory of 1804 4076 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 82 PID 4076 wrote to memory of 1804 4076 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 82 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25 PID 1804 wrote to memory of 2712 1804 c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe 25
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe"C:\Users\Admin\AppData\Local\Temp\c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exeC:\Users\Admin\AppData\Local\Temp\c8a6a2b05e176730b09ed57fb3c5a875c97a372ed226a3d2f272a62ad437bff4.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1804
-
-