Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231130-en -
resource tags
arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system -
submitted
05-12-2023 17:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
africpiou.exe
Resource
win7-20231130-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
africpiou.exe
Resource
win10v2004-20231130-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
africpiou.exe
-
Size
331KB
-
MD5
cb407edd867bb298d86ad82c2b4e7032
-
SHA1
2efcca5f28ccb1926ac128e5197839f13af01983
-
SHA256
f4cf2a5eba5104f17dcadf06a03a269157bfe9bb726c4bf0291519f47c2736f2
-
SHA512
1dd3ec12a42d1d898dce05cee613e80aca2b3190561f6ccf38569e9feee5a9d48ae0fd6439d4a2c4754c2c48146c37d6fbcf46543d189939e89ddfaa0adcf106
-
SSDEEP
6144:fGS74D4ji0736hkiSMCbGc1mqF32UiYRcENIysJGlq2a+gC0Noe+ek:eS0j0736ufEcsmL1cE25JGlq2aDrW
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
africpiou.exedescription pid process target process PID 1668 set thread context of 2756 1668 africpiou.exe africpiou.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
africpiou.exedescription pid process target process PID 1668 wrote to memory of 2756 1668 africpiou.exe africpiou.exe PID 1668 wrote to memory of 2756 1668 africpiou.exe africpiou.exe PID 1668 wrote to memory of 2756 1668 africpiou.exe africpiou.exe PID 1668 wrote to memory of 2756 1668 africpiou.exe africpiou.exe PID 1668 wrote to memory of 2756 1668 africpiou.exe africpiou.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\africpiou.exe"C:\Users\Admin\AppData\Local\Temp\africpiou.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\africpiou.exe"C:\Users\Admin\AppData\Local\Temp\africpiou.exe"2⤵PID:2756