Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25/01/2024, 02:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7382fd001ab212521ab06a7385256361.exe
Resource
win7-20231129-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
7382fd001ab212521ab06a7385256361.exe
Resource
win10v2004-20231215-en
0 signatures
150 seconds
General
-
Target
7382fd001ab212521ab06a7385256361.exe
-
Size
1.0MB
-
MD5
7382fd001ab212521ab06a7385256361
-
SHA1
a9531d4a35f5970ccdc054c4538de29f03211307
-
SHA256
426ea2a2ebd59b713abd38d2ad37e0f9038946c65fd3ac8a74660aaf2709837f
-
SHA512
db86c597e6f1afb031979d4b34864b47619c07deb476fb5ddab239da3855e74adad512f9d6dad6c22429221279bb16539e84986eaecf33351822de1df9618236
-
SSDEEP
24576:FbHHpHQg+wdPmZGkPbjOW5zeLVodDkj9egjiWB4saOz/AwVCuCdI3dYFR:FjHpHGmEGkzjOsocD1IiWustVtjSf
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2900 7382fd001ab212521ab06a7385256361.exe 2900 7382fd001ab212521ab06a7385256361.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2900 wrote to memory of 1384 2900 7382fd001ab212521ab06a7385256361.exe 7 PID 2900 wrote to memory of 1384 2900 7382fd001ab212521ab06a7385256361.exe 7 PID 2900 wrote to memory of 1384 2900 7382fd001ab212521ab06a7385256361.exe 7 PID 2900 wrote to memory of 1384 2900 7382fd001ab212521ab06a7385256361.exe 7 PID 2900 wrote to memory of 1384 2900 7382fd001ab212521ab06a7385256361.exe 7 PID 2900 wrote to memory of 1384 2900 7382fd001ab212521ab06a7385256361.exe 7
Processes
-
C:\Users\Admin\AppData\Local\Temp\7382fd001ab212521ab06a7385256361.exe"C:\Users\Admin\AppData\Local\Temp\7382fd001ab212521ab06a7385256361.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2900
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1384