Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
05-10-2023 23:43
Behavioral task
behavioral1
Sample
Psapi.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Psapi.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
winexp.chm
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
winexp.chm
Resource
win10v2004-20230915-en
Behavioral task
behavioral5
Sample
winexp.exe
Resource
win7-20230831-en
Behavioral task
behavioral6
Sample
winexp.exe
Resource
win10v2004-20230915-en
General
-
Target
winexp.exe
-
Size
51KB
-
MD5
20fe176f5d63cb53bdeb227410238ef0
-
SHA1
6012c9a32950047fb2f0d429c7fbe5a572ed370b
-
SHA256
6ee2ee07fa47e4512595dfa8ec8747c956db0eb716e420390cfceb8a318c4c2b
-
SHA512
43163ac68f91581fb93c7517e60bd7254bab0fe65acd523071fc6543cda2592540906f1127642ab78f595b52500e3b0c115c72c8e094a48243fb7c8b456ca8fe
-
SSDEEP
384:tpGpzwRgH8tNkmfN6QlK6Wcj7yo895m1iqgaya28KKDETKDIPKDRfs2xiqVaaaau:tpGy4nxpnU1Tya28T6L4JYxq4xKzF
Malware Config
Signatures
-
resource yara_rule behavioral6/memory/3024-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral6/memory/3024-1-0x0000000000400000-0x0000000000420000-memory.dmp upx -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3024 winexp.exe