Analysis
-
max time kernel
270s -
max time network
278s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
19-09-2023 06:52
Static task
static1
Behavioral task
behavioral1
Sample
k8684673.exe
Resource
win7-20230831-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral2
Sample
k8684673.exe
Resource
win10-20230915-en
windows10-1703-x64
2 signatures
300 seconds
General
-
Target
k8684673.exe
-
Size
371KB
-
MD5
92d7903295eeca59b8ccd1f6299eda7b
-
SHA1
4555db3293cc8498017b58eb6fd5fabc0073f94e
-
SHA256
1f1b8f4b7f148de3f489277914f06ba6228fb7bea8ef497cb75c2144e4e2b28b
-
SHA512
5c5ba099e60a15b4339b214f83f68faaceddfc91b67f89295899233d4b10e1d74cde2a6e9bd81a8a20c3857eed6ad0c7e52a98dede8768ba8d7d6abf172ff29a
-
SSDEEP
6144:YwvJm09zORs+z/TMify9DAOUgQls0fqfmZ0kfMFX3aBsNYWNNWL+TI8eIttm8/:Ygw09CK5NTgs/xRjNYWNG+/eIi8/
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
k8684673.exedescription pid process target process PID 4172 set thread context of 2732 4172 k8684673.exe AppLaunch.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
k8684673.exedescription pid process target process PID 4172 wrote to memory of 2824 4172 k8684673.exe AppLaunch.exe PID 4172 wrote to memory of 2824 4172 k8684673.exe AppLaunch.exe PID 4172 wrote to memory of 2824 4172 k8684673.exe AppLaunch.exe PID 4172 wrote to memory of 2732 4172 k8684673.exe AppLaunch.exe PID 4172 wrote to memory of 2732 4172 k8684673.exe AppLaunch.exe PID 4172 wrote to memory of 2732 4172 k8684673.exe AppLaunch.exe PID 4172 wrote to memory of 2732 4172 k8684673.exe AppLaunch.exe PID 4172 wrote to memory of 2732 4172 k8684673.exe AppLaunch.exe PID 4172 wrote to memory of 2732 4172 k8684673.exe AppLaunch.exe PID 4172 wrote to memory of 2732 4172 k8684673.exe AppLaunch.exe PID 4172 wrote to memory of 2732 4172 k8684673.exe AppLaunch.exe PID 4172 wrote to memory of 2732 4172 k8684673.exe AppLaunch.exe PID 4172 wrote to memory of 2732 4172 k8684673.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\k8684673.exe"C:\Users\Admin\AppData\Local\Temp\k8684673.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:2824
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:2732