Analysis
-
max time kernel
15s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
13-02-2024 14:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
upload.exe
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
upload.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
upload.exe
-
Size
638KB
-
MD5
a4e38bef52cdd304fc8efbb9933cae8e
-
SHA1
0caadb6512a2797d5b99047b44fab1e45084a91c
-
SHA256
4d010b1ff21191067838ca4b5f593bfc06900823851b5e1eea4f1c269b29d271
-
SHA512
7e6b5d6e24e4f27d5586f5a145ee065a6b1734f067ce32f73b74795ffa6367b67560ee853f48801ff18530cf42c745294bbe0818129c6f8fec184646357c91e2
-
SSDEEP
12288:y/Q+IIXkiPjpLr5pvId4i1qyR44I2eZrnln5n+b/Myjo4xrMnzpB9k:ZVWTiRqyR44INplnsbhj/xrMzv9
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2400 set thread context of 2792 2400 upload.exe 28 -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2400 wrote to memory of 2792 2400 upload.exe 28 PID 2400 wrote to memory of 2792 2400 upload.exe 28 PID 2400 wrote to memory of 2792 2400 upload.exe 28 PID 2400 wrote to memory of 2792 2400 upload.exe 28 PID 2400 wrote to memory of 2792 2400 upload.exe 28 PID 2400 wrote to memory of 2792 2400 upload.exe 28 PID 2400 wrote to memory of 2792 2400 upload.exe 28 PID 2400 wrote to memory of 2792 2400 upload.exe 28 PID 2400 wrote to memory of 2792 2400 upload.exe 28 PID 2400 wrote to memory of 2792 2400 upload.exe 28 PID 2400 wrote to memory of 2792 2400 upload.exe 28 PID 2400 wrote to memory of 2792 2400 upload.exe 28 PID 2400 wrote to memory of 2792 2400 upload.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\upload.exe"C:\Users\Admin\AppData\Local\Temp\upload.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:2792
-