Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/03/2024, 14:48
Static task
static1
Behavioral task
behavioral1
Sample
b7aa6d093cd855e709360593003f179e.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
b7aa6d093cd855e709360593003f179e.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
b7aa6d093cd855e709360593003f179e.exe
-
Size
461KB
-
MD5
b7aa6d093cd855e709360593003f179e
-
SHA1
17b0dcb2d8395953af07f40106eed55392ac10e4
-
SHA256
212d52c77ffcf32e2785cf7b28494d471e09a7e6b4f9c1f5cad170746b1d8c72
-
SHA512
df0d83297efa7738f86ee2ad82bce4fa7c181264dfffc6747fb2ad7deedd9cfbc63c15e4e80a7ba53a0abab0a2bbbb5224ac6e7a90cbaf8e3f9673cbe67ae320
-
SSDEEP
12288:4KrfwCVEtKwBVjxubwS9CzdKIEjpM4Ugr:4ofnrwPjx099EwIEdM9gr
Score
1/10
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1020 PING.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3628 wrote to memory of 4688 3628 b7aa6d093cd855e709360593003f179e.exe 98 PID 3628 wrote to memory of 4688 3628 b7aa6d093cd855e709360593003f179e.exe 98 PID 3628 wrote to memory of 4688 3628 b7aa6d093cd855e709360593003f179e.exe 98 PID 4688 wrote to memory of 1020 4688 cmd.exe 100 PID 4688 wrote to memory of 1020 4688 cmd.exe 100 PID 4688 wrote to memory of 1020 4688 cmd.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7aa6d093cd855e709360593003f179e.exe"C:\Users\Admin\AppData\Local\Temp\b7aa6d093cd855e709360593003f179e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\b7aa6d093cd855e709360593003f179e.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30003⤵
- Runs ping.exe
PID:1020
-
-