Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
07-01-2024 11:19
Behavioral task
behavioral1
Sample
48d4b01370550facb89bfd608588bd95.exe
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
48d4b01370550facb89bfd608588bd95.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
48d4b01370550facb89bfd608588bd95.exe
-
Size
33KB
-
MD5
48d4b01370550facb89bfd608588bd95
-
SHA1
a131f300b29d0d5d3f681dbdb70be32d6c0f82a1
-
SHA256
7b9ab3214fc6cd2ee076db3d56ad50d632d69ba64358099fd11faeba18bafcf8
-
SHA512
d422b8062891d66392797d897bb7ba3905e61a98ede861e82d1a944c6b90732670aacce8525e5ff26225ab4b62be9d0981d6edc74c6a7a228d1509444415599f
-
SSDEEP
384:qKFJ6xvBWCF+eARbepVI5I6uQ86K39DOLIG5pXaQPFtNat8adUJQbSWpdf7mq8ZO:qKFJ610eAJepVe/86K3VoFPYNGlpGt
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2816-0-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral2/memory/2816-3-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral2/memory/2816-10-0x0000000000400000-0x0000000000418000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2816 48d4b01370550facb89bfd608588bd95.exe 2816 48d4b01370550facb89bfd608588bd95.exe 2816 48d4b01370550facb89bfd608588bd95.exe 2816 48d4b01370550facb89bfd608588bd95.exe 2816 48d4b01370550facb89bfd608588bd95.exe 2816 48d4b01370550facb89bfd608588bd95.exe 2816 48d4b01370550facb89bfd608588bd95.exe 2816 48d4b01370550facb89bfd608588bd95.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 676 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2816 48d4b01370550facb89bfd608588bd95.exe