Analysis
-
max time kernel
145s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
25/02/2024, 07:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a33e4d428cd7db148dbe7ca1fdfede2f.exe
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
a33e4d428cd7db148dbe7ca1fdfede2f.exe
Resource
win10v2004-20240221-en
2 signatures
150 seconds
General
-
Target
a33e4d428cd7db148dbe7ca1fdfede2f.exe
-
Size
56KB
-
MD5
a33e4d428cd7db148dbe7ca1fdfede2f
-
SHA1
536b013ce90441064631252a82941c000d3c3cdc
-
SHA256
a1fd9e1a091ecef54ea453a68964a77a498d7ec32f974b637e555e791b915e19
-
SHA512
96ad6d41622dece12803f9e67a798c2bdac6071625701a4aa26e3d68daa6aac2df83ed5b7f1db884717f2c3c3812c9008b73930a883826af30d6c0e7bcd4a9b3
-
SSDEEP
1536:kZ/nEkh8OTKNqQi+BcN5fKgWmkt2RkRe8qA:axhTKNLi3fWsRkRenA
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2164 a33e4d428cd7db148dbe7ca1fdfede2f.exe 2164 a33e4d428cd7db148dbe7ca1fdfede2f.exe 2164 a33e4d428cd7db148dbe7ca1fdfede2f.exe 2164 a33e4d428cd7db148dbe7ca1fdfede2f.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2164 wrote to memory of 3620 2164 a33e4d428cd7db148dbe7ca1fdfede2f.exe 30 PID 2164 wrote to memory of 3620 2164 a33e4d428cd7db148dbe7ca1fdfede2f.exe 30 PID 2164 wrote to memory of 3620 2164 a33e4d428cd7db148dbe7ca1fdfede2f.exe 30 PID 2164 wrote to memory of 3620 2164 a33e4d428cd7db148dbe7ca1fdfede2f.exe 30
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\a33e4d428cd7db148dbe7ca1fdfede2f.exe"C:\Users\Admin\AppData\Local\Temp\a33e4d428cd7db148dbe7ca1fdfede2f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2164
-