Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
21/08/2023, 20:20
Behavioral task
behavioral1
Sample
f237f8824b3c1e68f9bd3a7159baef2aaf9a67de1802729dabae45bd609cd494.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
f237f8824b3c1e68f9bd3a7159baef2aaf9a67de1802729dabae45bd609cd494.exe
Resource
win10v2004-20230703-en
3 signatures
150 seconds
General
-
Target
f237f8824b3c1e68f9bd3a7159baef2aaf9a67de1802729dabae45bd609cd494.exe
-
Size
2.7MB
-
MD5
12986f99ad0c296a7f1938ab6e92a3b0
-
SHA1
fb15d68166ab0d24c749abb4c8ea5143fc1d52b8
-
SHA256
f237f8824b3c1e68f9bd3a7159baef2aaf9a67de1802729dabae45bd609cd494
-
SHA512
b7a28a4dff7c01b193569bc17f381835e6b422532c00116fac620de0e92985519452dd154ff3bd66fea6b87b96116753b3cb9756e2a625b2c4e70e7e77ef3c1b
-
SSDEEP
49152:SQ5RVVmXwW47yeOvyONpPtefJOrTTNfN5LlcOMZFTca6Xns2G:pTjl7ivyONpVeBaTTfcrF6XPG
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2060-54-0x0000000000400000-0x0000000000E2A000-memory.dmp upx behavioral1/memory/2060-56-0x0000000000400000-0x0000000000E2A000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2060 f237f8824b3c1e68f9bd3a7159baef2aaf9a67de1802729dabae45bd609cd494.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2060 f237f8824b3c1e68f9bd3a7159baef2aaf9a67de1802729dabae45bd609cd494.exe 2060 f237f8824b3c1e68f9bd3a7159baef2aaf9a67de1802729dabae45bd609cd494.exe 2060 f237f8824b3c1e68f9bd3a7159baef2aaf9a67de1802729dabae45bd609cd494.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f237f8824b3c1e68f9bd3a7159baef2aaf9a67de1802729dabae45bd609cd494.exe"C:\Users\Admin\AppData\Local\Temp\f237f8824b3c1e68f9bd3a7159baef2aaf9a67de1802729dabae45bd609cd494.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2060