Analysis
-
max time kernel
131s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2023 15:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
782244db11f9cb911a1663a9b96f2183.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
782244db11f9cb911a1663a9b96f2183.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
782244db11f9cb911a1663a9b96f2183.exe
-
Size
82KB
-
MD5
782244db11f9cb911a1663a9b96f2183
-
SHA1
33ffa7ca2273cb8f337ac9a1c4c05648cea949a6
-
SHA256
92bb40d4ef7be35fa1cbe7af22b558bf1ec11ba35eb9a7d6bbec5b8001f76e55
-
SHA512
d58344d11d63761b0d80623620719bdceac2c53ad34b0afd6afee4e85699e46897ffa6aeec4aaf91f5542aecfadd77d0b6c67042c7f07f3fe351aef43760b0b9
-
SSDEEP
1536:+wDcRB5qwIaX+5Kt5nBm+sN3qfBfxHUhyRg4:PDmBAwIA+C5cDJqfKqg4
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2400 782244db11f9cb911a1663a9b96f2183.exe -
Executes dropped EXE 1 IoCs
pid Process 2400 782244db11f9cb911a1663a9b96f2183.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2908 782244db11f9cb911a1663a9b96f2183.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2908 782244db11f9cb911a1663a9b96f2183.exe 2400 782244db11f9cb911a1663a9b96f2183.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2908 wrote to memory of 2400 2908 782244db11f9cb911a1663a9b96f2183.exe 89 PID 2908 wrote to memory of 2400 2908 782244db11f9cb911a1663a9b96f2183.exe 89 PID 2908 wrote to memory of 2400 2908 782244db11f9cb911a1663a9b96f2183.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\782244db11f9cb911a1663a9b96f2183.exe"C:\Users\Admin\AppData\Local\Temp\782244db11f9cb911a1663a9b96f2183.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\782244db11f9cb911a1663a9b96f2183.exeC:\Users\Admin\AppData\Local\Temp\782244db11f9cb911a1663a9b96f2183.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2400
-