Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
10-01-2024 16:57
Behavioral task
behavioral1
Sample
511bd280c4222a561cd3c48cb980ddd7.exe
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
511bd280c4222a561cd3c48cb980ddd7.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
511bd280c4222a561cd3c48cb980ddd7.exe
-
Size
37KB
-
MD5
511bd280c4222a561cd3c48cb980ddd7
-
SHA1
6d54171d08160e499dc37f7f2ec7e414b1723032
-
SHA256
e8384610927e49744a5d14a7a1c9501118b0c9c5c61799939ab330087f4b6d5b
-
SHA512
89b71554bd1a2648bb442ba6826ccd5021c0dad686021025553074ae6d5af361ed7b7b6c56108d19a96bf8303def9d50b7dfbec5853adc6113f56b3dd5f4fd79
-
SSDEEP
768:ZYegiyHmmVA7MVWXvXVGul4bdpllHTI0uffSLGrq8kQXHS:gNG1lGul4bdZHruSLskn
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2252 511bd280c4222a561cd3c48cb980ddd7.exe 2252 511bd280c4222a561cd3c48cb980ddd7.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2252 wrote to memory of 1208 2252 511bd280c4222a561cd3c48cb980ddd7.exe 14 PID 2252 wrote to memory of 1208 2252 511bd280c4222a561cd3c48cb980ddd7.exe 14 PID 2252 wrote to memory of 1208 2252 511bd280c4222a561cd3c48cb980ddd7.exe 14 PID 2252 wrote to memory of 1208 2252 511bd280c4222a561cd3c48cb980ddd7.exe 14
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\511bd280c4222a561cd3c48cb980ddd7.exe"C:\Users\Admin\AppData\Local\Temp\511bd280c4222a561cd3c48cb980ddd7.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2252
-