Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
09-10-2023 20:35
Behavioral task
behavioral1
Sample
b31afb055e518f4db1dbf51933524f4e39f013b696c9175def193dec2b486532.exe
Resource
win7-20230831-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
b31afb055e518f4db1dbf51933524f4e39f013b696c9175def193dec2b486532.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
b31afb055e518f4db1dbf51933524f4e39f013b696c9175def193dec2b486532.exe
-
Size
8.9MB
-
MD5
3c8efb72e8d39c373ae0e14e8a433cd1
-
SHA1
cf237602ed1deb0c4410497ea0edf2954352dd20
-
SHA256
b31afb055e518f4db1dbf51933524f4e39f013b696c9175def193dec2b486532
-
SHA512
bf097ab57e40876af1691236e200419e10366a54f4914b17d7d386dd11ba9e10a14e81eefeebf948731fd1b2361e25f57a5335a9eac37e412cf6bd72e5c1b5b1
-
SSDEEP
196608:CWdWBv03o4D/T8qgGLBMmCqV49U6A+1Uhr8WZYLn8rqIIY:CCqlMT8FbKhjr3I
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/796-3-0x0000000000400000-0x0000000001700000-memory.dmp vmprotect behavioral1/memory/796-40-0x0000000000400000-0x0000000001700000-memory.dmp vmprotect behavioral1/memory/796-41-0x0000000000400000-0x0000000001700000-memory.dmp vmprotect -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 796 b31afb055e518f4db1dbf51933524f4e39f013b696c9175def193dec2b486532.exe 796 b31afb055e518f4db1dbf51933524f4e39f013b696c9175def193dec2b486532.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 796 b31afb055e518f4db1dbf51933524f4e39f013b696c9175def193dec2b486532.exe 796 b31afb055e518f4db1dbf51933524f4e39f013b696c9175def193dec2b486532.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b31afb055e518f4db1dbf51933524f4e39f013b696c9175def193dec2b486532.exe"C:\Users\Admin\AppData\Local\Temp\b31afb055e518f4db1dbf51933524f4e39f013b696c9175def193dec2b486532.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:796