Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11-03-2024 16:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c1072c611f16ddeb1db87e622130a51a.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
c1072c611f16ddeb1db87e622130a51a.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
c1072c611f16ddeb1db87e622130a51a.exe
-
Size
54KB
-
MD5
c1072c611f16ddeb1db87e622130a51a
-
SHA1
b37c8894c06d3c296b3f58f2c8ba3f357f4f6d3f
-
SHA256
817dc004a2aac68cebe2fd8a0a3c382da4c5db2adc809c19a541facfdabe979d
-
SHA512
d84ba8d3ef0cde34c97a1ca61b000303a24afe5e5d16a6ec553e9dba10e54ee31bc3f737ef09fad8ac8a9f6bd188e51cdcb8e179011ae9a42a0764c82e6c0f1d
-
SSDEEP
768:nevFIYm0on6HGavZRtQffoaFNnioeQpYG0RN8vDckgRUgz9KjqQOYxwA3HyLt4pr:acV6HGavqgaCN4ck4iOQ3SDLt4pSXu
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1908 c1072c611f16ddeb1db87e622130a51a.exe 1908 c1072c611f16ddeb1db87e622130a51a.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1908 wrote to memory of 1288 1908 c1072c611f16ddeb1db87e622130a51a.exe 21 PID 1908 wrote to memory of 1288 1908 c1072c611f16ddeb1db87e622130a51a.exe 21 PID 1908 wrote to memory of 1288 1908 c1072c611f16ddeb1db87e622130a51a.exe 21 PID 1908 wrote to memory of 1288 1908 c1072c611f16ddeb1db87e622130a51a.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\c1072c611f16ddeb1db87e622130a51a.exe"C:\Users\Admin\AppData\Local\Temp\c1072c611f16ddeb1db87e622130a51a.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1908
-