Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08-03-2024 12:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bb514761b4dbe3d6cd10385745617dae.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
bb514761b4dbe3d6cd10385745617dae.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
bb514761b4dbe3d6cd10385745617dae.exe
-
Size
93KB
-
MD5
bb514761b4dbe3d6cd10385745617dae
-
SHA1
8c46a14ff50df744776ac0ccb01b9f88733c5d22
-
SHA256
c4d60545318db88963c1ec72e16720353fc5c5be5746b86ffdc5a1d3c3c9f1d6
-
SHA512
f5e16612eb9eaa7336f5254e6e896a0efaabde56803d5ff2290f5aa79458f3b237aa9fd00f96c022a32290fe60517e6e3dff34d402270d958c58d1a1c95922c5
-
SSDEEP
1536:A4GcRiXm4YQ9Sdt23IHbTcanuQxhMtkXrbStKxoj79lzk6HqeJQ7B:ATcBQ9S4KbT91hMtkXrbSwxoj79lzkJJ
Score
1/10
Malware Config
Signatures
-
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1980 bb514761b4dbe3d6cd10385745617dae.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1980 wrote to memory of 5020 1980 bb514761b4dbe3d6cd10385745617dae.exe 95 PID 1980 wrote to memory of 5020 1980 bb514761b4dbe3d6cd10385745617dae.exe 95 PID 1980 wrote to memory of 5020 1980 bb514761b4dbe3d6cd10385745617dae.exe 95 PID 1980 wrote to memory of 5020 1980 bb514761b4dbe3d6cd10385745617dae.exe 95 PID 1980 wrote to memory of 5020 1980 bb514761b4dbe3d6cd10385745617dae.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb514761b4dbe3d6cd10385745617dae.exe"C:\Users\Admin\AppData\Local\Temp\bb514761b4dbe3d6cd10385745617dae.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵PID:5020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1036 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:81⤵PID:392