Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
27-01-2024 15:43
Behavioral task
behavioral1
Sample
7aa2f47d3b960b717993b338705f442b.exe
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
General
-
Target
7aa2f47d3b960b717993b338705f442b.exe
-
Size
63KB
-
MD5
7aa2f47d3b960b717993b338705f442b
-
SHA1
12a7ab999312e41b83f67b6496376da18269df94
-
SHA256
157ed1654d7b6a6166a05e634c0df2785599086fda6e773ea7a723cfb3496668
-
SHA512
52f833b53a1e9d0e3079cc4bc484cbf3a2a0a9aa54b38150218d44434f0f7d91d67d8319486d607e8fc30688ebefb54b1498e95dab7b82e3bc95b6501be067b9
-
SSDEEP
768:oZ0xsb8grTI3XZY5hDOOpxMx6THDK1NpyVOYrkBvUQGOF8gfXMub0narzIfGZ+Di:oSxsYgwoDO1+2VmaXpNZ+23
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/3060-0-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral1/memory/3060-3-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral1/memory/3060-5-0x0000000000020000-0x000000000002C000-memory.dmp upx -
resource yara_rule behavioral1/memory/3060-0-0x0000000000400000-0x000000000040C000-memory.dmp vmprotect behavioral1/memory/3060-3-0x0000000000400000-0x000000000040C000-memory.dmp vmprotect behavioral1/memory/3060-5-0x0000000000020000-0x000000000002C000-memory.dmp vmprotect -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎx 7aa2f47d3b960b717993b338705f442b.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3060 7aa2f47d3b960b717993b338705f442b.exe