Analysis
-
max time kernel
143s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
05/01/2024, 19:26
Behavioral task
behavioral1
Sample
443fca575c714d3a08ea63c2862ed14a.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
443fca575c714d3a08ea63c2862ed14a.exe
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
443fca575c714d3a08ea63c2862ed14a.exe
-
Size
235KB
-
MD5
443fca575c714d3a08ea63c2862ed14a
-
SHA1
a251bae9d62c94d15c08f7a74ae22bdafa40748c
-
SHA256
40e517ad597661f36752426c3d3bf171f152df04b659422a1c0c7f2d832208f5
-
SHA512
4c57958271bab50fe2ccee6fed820fdae1e7a449f7611f06ff87f4222f333b92c835446dcedca7c89fa54cb8912d6912792c9058f8d1eb799d87ffbd72dd71cb
-
SSDEEP
3072:eJpvhlCVJn7C8MI4nj62F10BxKq+If5WWYJNJOGRYkP2WC+dVL53l:eJrlCV0TI+XgxKq3KYkEe3
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1492-0-0x0000000000400000-0x000000000043D000-memory.dmp upx -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1492 443fca575c714d3a08ea63c2862ed14a.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1492 wrote to memory of 3436 1492 443fca575c714d3a08ea63c2862ed14a.exe 91 PID 1492 wrote to memory of 3436 1492 443fca575c714d3a08ea63c2862ed14a.exe 91 PID 1492 wrote to memory of 3436 1492 443fca575c714d3a08ea63c2862ed14a.exe 91 PID 1492 wrote to memory of 3436 1492 443fca575c714d3a08ea63c2862ed14a.exe 91 PID 1492 wrote to memory of 3436 1492 443fca575c714d3a08ea63c2862ed14a.exe 91