Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
03-11-2023 16:06
Static task
static1
Behavioral task
behavioral1
Sample
6db1a052259fa4cddb376e310d75f469f103b04190334396a0b273a691c2e9a7.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
6db1a052259fa4cddb376e310d75f469f103b04190334396a0b273a691c2e9a7.exe
Resource
win10v2004-20231020-en
General
-
Target
6db1a052259fa4cddb376e310d75f469f103b04190334396a0b273a691c2e9a7.exe
-
Size
1.0MB
-
MD5
1219d15d2975660c320e2bba27561722
-
SHA1
b6f9b6b037f541a07c425ad1d79ad555f5d0e9ce
-
SHA256
6db1a052259fa4cddb376e310d75f469f103b04190334396a0b273a691c2e9a7
-
SHA512
9a39d7b23a439dd09f874f8d84465ca93a38a4ced7794573570fcf75e464846649411b6eb55d43646edc7639de318505b7eb214be2373b3e0839437ba38355bd
-
SSDEEP
12288:eV9rN6ENSGKLvAFqug9TKZ7xybNWarK+sc7xkxCCrnlwAPc534s4gE1a:enrNB0vaqx9T07o6TlwAZS
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 296 6db1a052259fa4cddb376e310d75f469f103b04190334396a0b273a691c2e9a7.exe 296 6db1a052259fa4cddb376e310d75f469f103b04190334396a0b273a691c2e9a7.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 296 wrote to memory of 2112 296 6db1a052259fa4cddb376e310d75f469f103b04190334396a0b273a691c2e9a7.exe 28 PID 296 wrote to memory of 2112 296 6db1a052259fa4cddb376e310d75f469f103b04190334396a0b273a691c2e9a7.exe 28 PID 296 wrote to memory of 2112 296 6db1a052259fa4cddb376e310d75f469f103b04190334396a0b273a691c2e9a7.exe 28 PID 296 wrote to memory of 2112 296 6db1a052259fa4cddb376e310d75f469f103b04190334396a0b273a691c2e9a7.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\6db1a052259fa4cddb376e310d75f469f103b04190334396a0b273a691c2e9a7.exe"C:\Users\Admin\AppData\Local\Temp\6db1a052259fa4cddb376e310d75f469f103b04190334396a0b273a691c2e9a7.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe2⤵PID:2112
-