Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-03-2024 11:31
Behavioral task
behavioral1
Sample
1840-134-0x0000000000400000-0x0000000000477000-memory.exe
Resource
win7-20240220-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
1840-134-0x0000000000400000-0x0000000000477000-memory.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
1840-134-0x0000000000400000-0x0000000000477000-memory.exe
-
Size
476KB
-
MD5
7d3aa8f9c9c514ccd3d46f6c8d88834b
-
SHA1
e609c6beebfac511f426fb53092237f62ad24ddb
-
SHA256
f05c566194635618c937165b48ecc712bc3f9d689367e4568c4c214ce9890a09
-
SHA512
cc273c3e7a48c7587dbb7158fd9fbf2653635ebb0463c7e130a0ba9b2f0b1ca0f73f153a40236a2fad4cc8035481767e69b06748032207fcdf7a8b100dc3048e
-
SSDEEP
12288:aBMa2SdiKUsNpyxGH6EdEQvrRuQ9/mG031ign8bxxW0OLWmJS:aua3diKtA+/CYrRuQ9/l4Axc+mo
Score
1/10
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1284 1840-134-0x0000000000400000-0x0000000000477000-memory.exe
Processes
Network
-
Remote address:8.8.8.8:53Request68.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request9.228.82.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request193.78.101.95.in-addr.arpaIN PTRResponse193.78.101.95.in-addr.arpaIN PTRa95-101-78-193deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request41.110.16.96.in-addr.arpaIN PTRResponse41.110.16.96.in-addr.arpaIN PTRa96-16-110-41deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request86.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request56.126.166.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request18.134.221.88.in-addr.arpaIN PTRResponse18.134.221.88.in-addr.arpaIN PTRa88-221-134-18deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request173.178.17.96.in-addr.arpaIN PTRResponse173.178.17.96.in-addr.arpaIN PTRa96-17-178-173deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request9.173.189.20.in-addr.arpaIN PTRResponse
No results found
-
71 B 157 B 1 1
DNS Request
68.32.126.40.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
9.228.82.20.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
193.78.101.95.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
41.110.16.96.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
86.23.85.13.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
56.126.166.20.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
18.134.221.88.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
173.178.17.96.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
14.227.111.52.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
9.173.189.20.in-addr.arpa