Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2023 10:12
Static task
static1
Behavioral task
behavioral1
Sample
66577ecf6daecc1c2fa84a5801434df2.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
66577ecf6daecc1c2fa84a5801434df2.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
66577ecf6daecc1c2fa84a5801434df2.exe
-
Size
458KB
-
MD5
66577ecf6daecc1c2fa84a5801434df2
-
SHA1
628a5341592da91b91e943ec69663b8525bae878
-
SHA256
23477658d727ac1ba0839c105f2e361d15677ca803264bd1a1b2e786a1823766
-
SHA512
d8719419ad3ce906c22e835cd1a371e1b82dca15c3a61d5fccbe4cea0a6deaa0791d07f1c429f91e3b35ca8c1208c149a6bdadf7c7e153d973eb1942446acf15
-
SSDEEP
6144:3fCleiQdMr7MZH/sEibAH5cne9hB1Z7mvGS5S+MTEOZqLn6it6f+K:Ppi7MZH+k5cnihBLu5SzE9z6nz
Score
1/10
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3436 PING.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4156 wrote to memory of 4788 4156 66577ecf6daecc1c2fa84a5801434df2.exe 91 PID 4156 wrote to memory of 4788 4156 66577ecf6daecc1c2fa84a5801434df2.exe 91 PID 4156 wrote to memory of 4788 4156 66577ecf6daecc1c2fa84a5801434df2.exe 91 PID 4788 wrote to memory of 3436 4788 cmd.exe 93 PID 4788 wrote to memory of 3436 4788 cmd.exe 93 PID 4788 wrote to memory of 3436 4788 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\66577ecf6daecc1c2fa84a5801434df2.exe"C:\Users\Admin\AppData\Local\Temp\66577ecf6daecc1c2fa84a5801434df2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\66577ecf6daecc1c2fa84a5801434df2.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30003⤵
- Runs ping.exe
PID:3436
-
-