Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 10:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
165b5aee5e5934e795665fc831410ba7.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
165b5aee5e5934e795665fc831410ba7.exe
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
165b5aee5e5934e795665fc831410ba7.exe
-
Size
88KB
-
MD5
165b5aee5e5934e795665fc831410ba7
-
SHA1
11739362c07e81b902d1203d795cbd53a17874a2
-
SHA256
0a3b06491b8b607c2412f6e11e267b0b358a3a84397ba8012fca12e3196782de
-
SHA512
9e76ad468dddc0d0bb557a35c2f1f57d91680f1ed73027182c5f373e8146a3e63cd6e9f1aa2d6052e15dfff8edca64c081aa6a3c6abbfb364cb99643f696aed6
-
SSDEEP
1536:LCqQ8HpLiBodXd/Lvyn8hEFC39xRFY4EkYsWFhREk975M+GPt8HpL:jplXhLan8hEPREQM+GPkp
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2216 165b5aee5e5934e795665fc831410ba7.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2216 165b5aee5e5934e795665fc831410ba7.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2216 wrote to memory of 3056 2216 165b5aee5e5934e795665fc831410ba7.exe 28 PID 2216 wrote to memory of 3056 2216 165b5aee5e5934e795665fc831410ba7.exe 28 PID 2216 wrote to memory of 3056 2216 165b5aee5e5934e795665fc831410ba7.exe 28 PID 2216 wrote to memory of 3056 2216 165b5aee5e5934e795665fc831410ba7.exe 28 PID 2216 wrote to memory of 3056 2216 165b5aee5e5934e795665fc831410ba7.exe 28 PID 2216 wrote to memory of 3056 2216 165b5aee5e5934e795665fc831410ba7.exe 28 PID 2216 wrote to memory of 3056 2216 165b5aee5e5934e795665fc831410ba7.exe 28 PID 2216 wrote to memory of 3032 2216 165b5aee5e5934e795665fc831410ba7.exe 29 PID 2216 wrote to memory of 3032 2216 165b5aee5e5934e795665fc831410ba7.exe 29 PID 2216 wrote to memory of 3032 2216 165b5aee5e5934e795665fc831410ba7.exe 29 PID 2216 wrote to memory of 3032 2216 165b5aee5e5934e795665fc831410ba7.exe 29 PID 2216 wrote to memory of 3032 2216 165b5aee5e5934e795665fc831410ba7.exe 29 PID 2216 wrote to memory of 3032 2216 165b5aee5e5934e795665fc831410ba7.exe 29 PID 2216 wrote to memory of 3032 2216 165b5aee5e5934e795665fc831410ba7.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\165b5aee5e5934e795665fc831410ba7.exe"C:\Users\Admin\AppData\Local\Temp\165b5aee5e5934e795665fc831410ba7.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe \DLL\e_beyan_indir.dll /s2⤵PID:3056
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe \DLL\e_beyan_indir_mlt.dll /s2⤵PID:3032
-