Analysis
-
max time kernel
148s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26-12-2023 09:10
Behavioral task
behavioral1
Sample
6289c1808db5dfef5196f705b57f73ce.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
6289c1808db5dfef5196f705b57f73ce.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
6289c1808db5dfef5196f705b57f73ce.exe
-
Size
104KB
-
MD5
6289c1808db5dfef5196f705b57f73ce
-
SHA1
f7f1e36e37a856d6be46472715e44ff05aac3f2c
-
SHA256
52de77c2dbd3a26cc5115f2da3db6575b793954dd9fd4c45345510b68aa7ddab
-
SHA512
24e84d751177d348e024592b3dff7afa2c9c1367c5efcb5c03e1ec64ea6146a4ce0f8c1a8bfa8ead4220a839b75ac31b5624df2597f4d1d632d5b056f5664b6f
-
SSDEEP
3072:PJGtgVl6+iYRpYU8npxRH3zzkZ6VQS5Soi:PJGeSEGU8p3HY6VQgFi
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2076-0-0x0000000000400000-0x0000000000422000-memory.dmp upx -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2076 6289c1808db5dfef5196f705b57f73ce.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2076 wrote to memory of 2928 2076 6289c1808db5dfef5196f705b57f73ce.exe 14 PID 2076 wrote to memory of 2928 2076 6289c1808db5dfef5196f705b57f73ce.exe 14 PID 2076 wrote to memory of 2928 2076 6289c1808db5dfef5196f705b57f73ce.exe 14 PID 2076 wrote to memory of 2928 2076 6289c1808db5dfef5196f705b57f73ce.exe 14 PID 2076 wrote to memory of 2928 2076 6289c1808db5dfef5196f705b57f73ce.exe 14 PID 2076 wrote to memory of 2928 2076 6289c1808db5dfef5196f705b57f73ce.exe 14 PID 2076 wrote to memory of 2928 2076 6289c1808db5dfef5196f705b57f73ce.exe 14