Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/03/2024, 21:23
Behavioral task
behavioral1
Sample
e0201118fb82f6c882c8506c9f9f623a.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
e0201118fb82f6c882c8506c9f9f623a.exe
Resource
win10v2004-20240226-en
3 signatures
150 seconds
General
-
Target
e0201118fb82f6c882c8506c9f9f623a.exe
-
Size
173KB
-
MD5
e0201118fb82f6c882c8506c9f9f623a
-
SHA1
ab8f5603657fe2ec49912938a11afbaadaba09d6
-
SHA256
14cf4176f0ca5ab6eed69466b6e691aafcaeda769fe05e9cf9ea86d3bf9ac22a
-
SHA512
059ed73635f7fc8ed197c1fe92963c421e63ce723c6691968e39d10a0667928ef4f0c3b244f86ddf3cc2595a3834bae82e518d3f1df961b059335beee5379680
-
SSDEEP
3072:/2ZKowEG9zW1Wtx0PwSF89UzQA2vFSDjCd3WmnumTJ:/doPYzht6zYvFd33BT
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2076-0-0x0000000000400000-0x000000000042D000-memory.dmp upx -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2076 e0201118fb82f6c882c8506c9f9f623a.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2076 wrote to memory of 1392 2076 e0201118fb82f6c882c8506c9f9f623a.exe 21 PID 2076 wrote to memory of 1392 2076 e0201118fb82f6c882c8506c9f9f623a.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\e0201118fb82f6c882c8506c9f9f623a.exe"C:\Users\Admin\AppData\Local\Temp\e0201118fb82f6c882c8506c9f9f623a.exe"2⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2076
-