Analysis
-
max time kernel
153s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
14/10/2023, 03:43
Behavioral task
behavioral1
Sample
fed26b6860152e0bd5e5b416cb4732b4e15652dcfdb1780e4f056643b89eecdf.exe
Resource
win7-20230831-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
fed26b6860152e0bd5e5b416cb4732b4e15652dcfdb1780e4f056643b89eecdf.exe
Resource
win10v2004-20230915-en
2 signatures
150 seconds
General
-
Target
fed26b6860152e0bd5e5b416cb4732b4e15652dcfdb1780e4f056643b89eecdf.exe
-
Size
13.2MB
-
MD5
71e47d12a1ad53de17005624475af554
-
SHA1
bceeebb3985016d93b5fc63a8d3462fecbe1db53
-
SHA256
fed26b6860152e0bd5e5b416cb4732b4e15652dcfdb1780e4f056643b89eecdf
-
SHA512
d2195126a65b942f98b37006a21bdcd33292017345c6847219e76c318cca919cdc85c16c3038369cc7dc3e34f0d1779fc7894bfd4eae15a2748a3934716bb335
-
SSDEEP
393216:6d0PvHK5RPUG1LOMNXtN+zVKlDrRompotaloLmM1ims1ptn:XS/IyhtrampSfmMYms1ptn
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1288-0-0x00000000002D0000-0x0000000002D26000-memory.dmp upx behavioral1/memory/1288-1-0x00000000002D0000-0x0000000002D26000-memory.dmp upx -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1288 fed26b6860152e0bd5e5b416cb4732b4e15652dcfdb1780e4f056643b89eecdf.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1288 fed26b6860152e0bd5e5b416cb4732b4e15652dcfdb1780e4f056643b89eecdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fed26b6860152e0bd5e5b416cb4732b4e15652dcfdb1780e4f056643b89eecdf.exe"C:\Users\Admin\AppData\Local\Temp\fed26b6860152e0bd5e5b416cb4732b4e15652dcfdb1780e4f056643b89eecdf.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1288