Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
20/09/2023, 02:11
Behavioral task
behavioral1
Sample
d7a337cff3b39f03718dd028c5e36afa6ffb0cda1c7124b59d132d105ec2ec17.exe
Resource
win7-20230831-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
d7a337cff3b39f03718dd028c5e36afa6ffb0cda1c7124b59d132d105ec2ec17.exe
Resource
win10v2004-20230915-en
3 signatures
150 seconds
General
-
Target
d7a337cff3b39f03718dd028c5e36afa6ffb0cda1c7124b59d132d105ec2ec17.exe
-
Size
9.9MB
-
MD5
0f1f188d01bc01f1d009f397982a0515
-
SHA1
7e493dc5377f373af5b134d0152280a79d2b6963
-
SHA256
d7a337cff3b39f03718dd028c5e36afa6ffb0cda1c7124b59d132d105ec2ec17
-
SHA512
68678c4d2b39981c11d5f91f36b08dbe44d91748cec7c8997ee3100db527d5fb6ca13cfb553b71e75517c5934ade386093a69b25f7c332e1e76cac46e2ca1899
-
SSDEEP
196608:fY7cFXOEnWR9mP2j2Z993IjaBIvW89RLZJ1U2yNDS7MGNXPf3qmUZm:nJnf2aWWBI+c53ODS/XPf3qRZm
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/3032-0-0x0000000000400000-0x0000000001C94000-memory.dmp vmprotect behavioral1/memory/3032-5-0x0000000000400000-0x0000000001C94000-memory.dmp vmprotect behavioral1/memory/3032-14-0x0000000000400000-0x0000000001C94000-memory.dmp vmprotect behavioral1/memory/3032-15-0x0000000000400000-0x0000000001C94000-memory.dmp vmprotect -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3032 d7a337cff3b39f03718dd028c5e36afa6ffb0cda1c7124b59d132d105ec2ec17.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3032 d7a337cff3b39f03718dd028c5e36afa6ffb0cda1c7124b59d132d105ec2ec17.exe 3032 d7a337cff3b39f03718dd028c5e36afa6ffb0cda1c7124b59d132d105ec2ec17.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7a337cff3b39f03718dd028c5e36afa6ffb0cda1c7124b59d132d105ec2ec17.exe"C:\Users\Admin\AppData\Local\Temp\d7a337cff3b39f03718dd028c5e36afa6ffb0cda1c7124b59d132d105ec2ec17.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3032