Analysis
-
max time kernel
118s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11-10-2023 23:40
Static task
static1
Behavioral task
behavioral1
Sample
4d759c908f342eaa57e62142c103decb5b21f8fe1d5d6f8ac63c9f65eead831c.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
4d759c908f342eaa57e62142c103decb5b21f8fe1d5d6f8ac63c9f65eead831c.exe
Resource
win10v2004-20230915-en
General
-
Target
4d759c908f342eaa57e62142c103decb5b21f8fe1d5d6f8ac63c9f65eead831c.exe
-
Size
1.3MB
-
MD5
c870de52781c00abb111d305e11aafc8
-
SHA1
d43a98c9a31241595fa4d21a59032174ad2c948f
-
SHA256
4d759c908f342eaa57e62142c103decb5b21f8fe1d5d6f8ac63c9f65eead831c
-
SHA512
eef56b2cf54449dea3d1b14874c240b45a5cd96ce3e5515452f60483bbbfcae6c09054058361c470a4403abc01d393b625c963202358fea58432e2decaa33360
-
SSDEEP
24576:PF/0BbH5spQ5CAu7NDERYC1gs9cQ5wRydiJFaCwmr5Siv25:PF/MkAu7+yC1gs9cQ5wRRFaCwoVK
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2104 4d759c908f342eaa57e62142c103decb5b21f8fe1d5d6f8ac63c9f65eead831c.exe 2104 4d759c908f342eaa57e62142c103decb5b21f8fe1d5d6f8ac63c9f65eead831c.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2104 wrote to memory of 2124 2104 4d759c908f342eaa57e62142c103decb5b21f8fe1d5d6f8ac63c9f65eead831c.exe 28 PID 2104 wrote to memory of 2124 2104 4d759c908f342eaa57e62142c103decb5b21f8fe1d5d6f8ac63c9f65eead831c.exe 28 PID 2104 wrote to memory of 2124 2104 4d759c908f342eaa57e62142c103decb5b21f8fe1d5d6f8ac63c9f65eead831c.exe 28 PID 2104 wrote to memory of 2124 2104 4d759c908f342eaa57e62142c103decb5b21f8fe1d5d6f8ac63c9f65eead831c.exe 28 PID 2104 wrote to memory of 2124 2104 4d759c908f342eaa57e62142c103decb5b21f8fe1d5d6f8ac63c9f65eead831c.exe 28 PID 2104 wrote to memory of 2124 2104 4d759c908f342eaa57e62142c103decb5b21f8fe1d5d6f8ac63c9f65eead831c.exe 28 PID 2104 wrote to memory of 2124 2104 4d759c908f342eaa57e62142c103decb5b21f8fe1d5d6f8ac63c9f65eead831c.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d759c908f342eaa57e62142c103decb5b21f8fe1d5d6f8ac63c9f65eead831c.exe"C:\Users\Admin\AppData\Local\Temp\4d759c908f342eaa57e62142c103decb5b21f8fe1d5d6f8ac63c9f65eead831c.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s dm.dll2⤵PID:2124
-