Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
07/07/2024, 18:21
Static task
static1
Behavioral task
behavioral1
Sample
05f5bc18990354781f4cdca77415cf7091011150cc3fe061158b5cf665bb80de.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
05f5bc18990354781f4cdca77415cf7091011150cc3fe061158b5cf665bb80de.exe
Resource
win10v2004-20240704-en
General
-
Target
05f5bc18990354781f4cdca77415cf7091011150cc3fe061158b5cf665bb80de.exe
-
Size
4.4MB
-
MD5
6e2a544b4e6777f84a49df4c21774dad
-
SHA1
85f17c9687b4ef6e9fd9b34ef4d44ea62eb7de17
-
SHA256
05f5bc18990354781f4cdca77415cf7091011150cc3fe061158b5cf665bb80de
-
SHA512
62cfb1a49d4050e5f909790068722a6f80c52dc209382773653fccb2893e58040e6bbcdd7dd959f8958db921ebc5fbc9dab65e0cfa00a9d0c4a088e57109290e
-
SSDEEP
98304:st/QQ1+iYIs2S3TZV04EfN7+KjWWWWWWW/:st/7SIs2wZduN7+yWWWWWWW
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2120 05f5bc18990354781f4cdca77415cf7091011150cc3fe061158b5cf665bb80de.exe 2120 05f5bc18990354781f4cdca77415cf7091011150cc3fe061158b5cf665bb80de.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2120 wrote to memory of 2128 2120 05f5bc18990354781f4cdca77415cf7091011150cc3fe061158b5cf665bb80de.exe 30 PID 2120 wrote to memory of 2128 2120 05f5bc18990354781f4cdca77415cf7091011150cc3fe061158b5cf665bb80de.exe 30 PID 2120 wrote to memory of 2128 2120 05f5bc18990354781f4cdca77415cf7091011150cc3fe061158b5cf665bb80de.exe 30 PID 2120 wrote to memory of 2128 2120 05f5bc18990354781f4cdca77415cf7091011150cc3fe061158b5cf665bb80de.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\05f5bc18990354781f4cdca77415cf7091011150cc3fe061158b5cf665bb80de.exe"C:\Users\Admin\AppData\Local\Temp\05f5bc18990354781f4cdca77415cf7091011150cc3fe061158b5cf665bb80de.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2128
-