Analysis
-
max time kernel
59s -
max time network
25s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-03-2024 13:05
Static task
static1
Behavioral task
behavioral1
Sample
AutoIt3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
AutoIt3.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
script.au3
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
script.au3
Resource
win10v2004-20240226-en
General
-
Target
AutoIt3.exe
-
Size
872KB
-
MD5
c56b5f0201a3b3de53e561fe76912bfd
-
SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417
-
SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
-
SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
SSDEEP
12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
Malware Config
Signatures
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 2996 AutoIt3.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2996 2732 cmd.exe 30 PID 2732 wrote to memory of 2996 2732 cmd.exe 30 PID 2732 wrote to memory of 2996 2732 cmd.exe 30 PID 2732 wrote to memory of 2996 2732 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\AutoIt3.exeC:\Users\Admin\AppData\Local\Temp\AutoIt3.exe AutoIt3.exe script.au31⤵PID:2972
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\AutoIt3.exeAutoIt3.exe script.au32⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2996
-