Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
16-08-2023 12:01
Static task
static1
Behavioral task
behavioral1
Sample
3d09c3c2cdff44caaa9a40092eced7b69708ff4538aa11edb319a9a657406fda.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
3d09c3c2cdff44caaa9a40092eced7b69708ff4538aa11edb319a9a657406fda.exe
Resource
win10v2004-20230703-en
General
-
Target
3d09c3c2cdff44caaa9a40092eced7b69708ff4538aa11edb319a9a657406fda.exe
-
Size
98KB
-
MD5
89a3b4e69e0daf05e8877a50f5b065c4
-
SHA1
6393280644b1e9d9b8a14762acebdc3de758481f
-
SHA256
3d09c3c2cdff44caaa9a40092eced7b69708ff4538aa11edb319a9a657406fda
-
SHA512
737854155ae4be29274b4bdad00af1242e9cb9e6bd35a847f0f77c492e468b9d3554e6e6d47a133fad529ea2d3aa57e507c0872f3d1cc84145b8318b785fbb4a
-
SSDEEP
384:oqe+eOtEpdKeZ+nUm6y+eyclswj4wazFYk1eHnHLIIu1NdNPi/UDyWj60sbqoIxC:ouraTm6y/lswGhYcenM1NdNeQWbvwV
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2948 wrote to memory of 4304 2948 3d09c3c2cdff44caaa9a40092eced7b69708ff4538aa11edb319a9a657406fda.exe 92 PID 2948 wrote to memory of 4304 2948 3d09c3c2cdff44caaa9a40092eced7b69708ff4538aa11edb319a9a657406fda.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d09c3c2cdff44caaa9a40092eced7b69708ff4538aa11edb319a9a657406fda.exe"C:\Users\Admin\AppData\Local\Temp\3d09c3c2cdff44caaa9a40092eced7b69708ff4538aa11edb319a9a657406fda.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵PID:4304
-