Analysis
-
max time kernel
91s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
09/01/2023, 02:44
Static task
static1
Behavioral task
behavioral1
Sample
fce7d4ee8528fb390cf2a62d99b98188e4947943f7bb7200e94a7606c13971d5.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
fce7d4ee8528fb390cf2a62d99b98188e4947943f7bb7200e94a7606c13971d5.exe
Resource
win10v2004-20220812-en
General
-
Target
fce7d4ee8528fb390cf2a62d99b98188e4947943f7bb7200e94a7606c13971d5.exe
-
Size
41KB
-
MD5
c693f5e742b7e34ff536da3574847136
-
SHA1
2983529ce35714a7d8def2338cab8126a21a345d
-
SHA256
fce7d4ee8528fb390cf2a62d99b98188e4947943f7bb7200e94a7606c13971d5
-
SHA512
8a68beb958e3baa9e4325d793fcfb74a153e606986afe39daa8352702e7ea6ac1c89820eb2ba4424441b37356e05a1f9a2ec16c91a32a75ad65db76cc896f6dd
-
SSDEEP
384:LkiQynaz+kwfHnHjrLKoaKteWX5n47c8uL3jaf0mWe:Y36hfjrIKt5XjL3c0mR
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 740 wrote to memory of 4904 740 fce7d4ee8528fb390cf2a62d99b98188e4947943f7bb7200e94a7606c13971d5.exe 83 PID 740 wrote to memory of 4904 740 fce7d4ee8528fb390cf2a62d99b98188e4947943f7bb7200e94a7606c13971d5.exe 83 PID 740 wrote to memory of 2208 740 fce7d4ee8528fb390cf2a62d99b98188e4947943f7bb7200e94a7606c13971d5.exe 84 PID 740 wrote to memory of 2208 740 fce7d4ee8528fb390cf2a62d99b98188e4947943f7bb7200e94a7606c13971d5.exe 84 PID 740 wrote to memory of 4652 740 fce7d4ee8528fb390cf2a62d99b98188e4947943f7bb7200e94a7606c13971d5.exe 85 PID 740 wrote to memory of 4652 740 fce7d4ee8528fb390cf2a62d99b98188e4947943f7bb7200e94a7606c13971d5.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\fce7d4ee8528fb390cf2a62d99b98188e4947943f7bb7200e94a7606c13971d5.exe"C:\Users\Admin\AppData\Local\Temp\fce7d4ee8528fb390cf2a62d99b98188e4947943f7bb7200e94a7606c13971d5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c color 742⤵PID:4904
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c title Henry Z Chess Artificial Intelligence2⤵PID:2208
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c pause2⤵PID:4652
-