Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
08-01-2024 19:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4c52a5e40bca9de585ae88ce69b81abc.exe
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
4c52a5e40bca9de585ae88ce69b81abc.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
4c52a5e40bca9de585ae88ce69b81abc.exe
-
Size
31KB
-
MD5
4c52a5e40bca9de585ae88ce69b81abc
-
SHA1
cdca127eba1d30a83b024b363cbdb5109bf83fdb
-
SHA256
34837f5b2cf55fb891f85400fb4f79ab408cc79455b6b22d621e0e133b1492a2
-
SHA512
7f8bbe8409c2dc97ac94841df55ab6b47f5394c3adfc5ffbbe30eff0b55020d3901180abb637bf19b1d062dae84b1c826700a79801ac45d60cd343b3222c2e38
-
SSDEEP
768:5Zh7TzTBziifTeiZSVWihwEEnB0L7uTLhNfQffJh:LZ/nEEB8uTNNOh
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1320 4c52a5e40bca9de585ae88ce69b81abc.exe 1320 4c52a5e40bca9de585ae88ce69b81abc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1320 wrote to memory of 1188 1320 4c52a5e40bca9de585ae88ce69b81abc.exe 12 PID 1320 wrote to memory of 1188 1320 4c52a5e40bca9de585ae88ce69b81abc.exe 12 PID 1320 wrote to memory of 1188 1320 4c52a5e40bca9de585ae88ce69b81abc.exe 12 PID 1320 wrote to memory of 1188 1320 4c52a5e40bca9de585ae88ce69b81abc.exe 12
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\4c52a5e40bca9de585ae88ce69b81abc.exe"C:\Users\Admin\AppData\Local\Temp\4c52a5e40bca9de585ae88ce69b81abc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1320
-