Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
03/01/2024, 21:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3ed53e32e8fcbf1750a50117197691a6.exe
Resource
win7-20231129-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
3ed53e32e8fcbf1750a50117197691a6.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
3ed53e32e8fcbf1750a50117197691a6.exe
-
Size
31KB
-
MD5
3ed53e32e8fcbf1750a50117197691a6
-
SHA1
768eaf2907625bb6d89031a022f49aa8b29fd53c
-
SHA256
b7697ee4d1b5b6fd4dfce2699353d90b7be7932d5317de1590e410e7b0831fbb
-
SHA512
cad1f1cafd3cd1636626c2af3dc13943f19f4a16fbda2c392089bf1d881d31e16d308fe40e1aba330fc32dd83b4873195873162bbdc992d0192522c687811197
-
SSDEEP
768:ZLh7TzTBziifTeiZSVWihwEEnh0L7OTLeNfQffJVV:ZZ/nEEh8OTKNOb
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1044 3ed53e32e8fcbf1750a50117197691a6.exe 1044 3ed53e32e8fcbf1750a50117197691a6.exe 1044 3ed53e32e8fcbf1750a50117197691a6.exe 1044 3ed53e32e8fcbf1750a50117197691a6.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1044 wrote to memory of 3460 1044 3ed53e32e8fcbf1750a50117197691a6.exe 49 PID 1044 wrote to memory of 3460 1044 3ed53e32e8fcbf1750a50117197691a6.exe 49 PID 1044 wrote to memory of 3460 1044 3ed53e32e8fcbf1750a50117197691a6.exe 49 PID 1044 wrote to memory of 3460 1044 3ed53e32e8fcbf1750a50117197691a6.exe 49
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ed53e32e8fcbf1750a50117197691a6.exe"C:\Users\Admin\AppData\Local\Temp\3ed53e32e8fcbf1750a50117197691a6.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1044
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3460