Analysis
-
max time kernel
197s -
max time network
210s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 14:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1b1c79d31c04d160fa9531c938633dc9.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
1b1c79d31c04d160fa9531c938633dc9.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
1b1c79d31c04d160fa9531c938633dc9.exe
-
Size
31KB
-
MD5
1b1c79d31c04d160fa9531c938633dc9
-
SHA1
9e5977adf5ffd1382abe52018031c4350fc06b5c
-
SHA256
3a64e5fde1cd87f45b1ed18fd7fcc7b70bc475b84754c05f6b4796c3b81d1881
-
SHA512
6433fdfa0fd4d058e0985a7b4ac35ab476cb8f2b79fe78f4ecefd199f96fbccefad7235a40711a1f493f36bcfadf66b9db5fe96a85118e297d78562120c6e632
-
SSDEEP
768:Z+h7TzTBziifTeiZSVWihwEknh0L7OTLeNfQfg:kZ/nEkh8OTKNd
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2376 1b1c79d31c04d160fa9531c938633dc9.exe 2376 1b1c79d31c04d160fa9531c938633dc9.exe 2376 1b1c79d31c04d160fa9531c938633dc9.exe 2376 1b1c79d31c04d160fa9531c938633dc9.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2376 wrote to memory of 3464 2376 1b1c79d31c04d160fa9531c938633dc9.exe 27 PID 2376 wrote to memory of 3464 2376 1b1c79d31c04d160fa9531c938633dc9.exe 27 PID 2376 wrote to memory of 3464 2376 1b1c79d31c04d160fa9531c938633dc9.exe 27 PID 2376 wrote to memory of 3464 2376 1b1c79d31c04d160fa9531c938633dc9.exe 27
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\1b1c79d31c04d160fa9531c938633dc9.exe"C:\Users\Admin\AppData\Local\Temp\1b1c79d31c04d160fa9531c938633dc9.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2376
-