Analysis
-
max time kernel
152s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13/01/2024, 23:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
59ae86c106d978af0a98618238e180b2.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
59ae86c106d978af0a98618238e180b2.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
59ae86c106d978af0a98618238e180b2.exe
-
Size
77KB
-
MD5
59ae86c106d978af0a98618238e180b2
-
SHA1
8d55055f4ed90c22f04167eb1733778e4357eee0
-
SHA256
40e269272dccedad8b4d81bb6eb9f74022182c9ae9ab9b399fe128a53762e0e1
-
SHA512
1a3a43d70864cdf9576b1b4ccba05f6951d1f87bbec481bbaf54ad857a3a989ed879827e0fa965bfa1fd249c6ab70c45349817ad71ae4f016ec465f642ce706a
-
SSDEEP
1536:acV6HGavqgaON4ck4iOQ3SDLt4pSXdQbHZzix65FbVHkr:acVqnv0JOQ38t4AXdQbHUmBBE
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1932 59ae86c106d978af0a98618238e180b2.exe 1932 59ae86c106d978af0a98618238e180b2.exe 1932 59ae86c106d978af0a98618238e180b2.exe 1932 59ae86c106d978af0a98618238e180b2.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1932 wrote to memory of 3440 1932 59ae86c106d978af0a98618238e180b2.exe 44 PID 1932 wrote to memory of 3440 1932 59ae86c106d978af0a98618238e180b2.exe 44 PID 1932 wrote to memory of 3440 1932 59ae86c106d978af0a98618238e180b2.exe 44 PID 1932 wrote to memory of 3440 1932 59ae86c106d978af0a98618238e180b2.exe 44
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\59ae86c106d978af0a98618238e180b2.exe"C:\Users\Admin\AppData\Local\Temp\59ae86c106d978af0a98618238e180b2.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1932
-