Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15-03-2024 06:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
caae98d65f47a244d159f76a98794d15.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
caae98d65f47a244d159f76a98794d15.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
caae98d65f47a244d159f76a98794d15.exe
-
Size
67KB
-
MD5
caae98d65f47a244d159f76a98794d15
-
SHA1
c267f8485c325858983345f3f51203f14d86426e
-
SHA256
ce4878168ef8f94c2f10b6d7648e975f20a4039c1272f2ac9ea69949f6d9559b
-
SHA512
a873168cb6a1b3bacd3d4abf7d31cb73ef79ac689c73dc76417969c6597abe6bcf4622af06357a56a7dce35450146920c1dfff0b05166ca53432d346f3dcf168
-
SSDEEP
1536:UcV6HGavqgarOBJyypgmDzVVlqQvDwS4yVHMOCyPBG:UcVqnvBnyypeODwS4jOC5
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2624 caae98d65f47a244d159f76a98794d15.exe 2624 caae98d65f47a244d159f76a98794d15.exe 2624 caae98d65f47a244d159f76a98794d15.exe 2624 caae98d65f47a244d159f76a98794d15.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2624 wrote to memory of 3540 2624 caae98d65f47a244d159f76a98794d15.exe 57 PID 2624 wrote to memory of 3540 2624 caae98d65f47a244d159f76a98794d15.exe 57 PID 2624 wrote to memory of 3540 2624 caae98d65f47a244d159f76a98794d15.exe 57 PID 2624 wrote to memory of 3540 2624 caae98d65f47a244d159f76a98794d15.exe 57
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\caae98d65f47a244d159f76a98794d15.exe"C:\Users\Admin\AppData\Local\Temp\caae98d65f47a244d159f76a98794d15.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2624
-