d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c

Analysis

Target

sodinokibi.exe
Size

143KB
MD5

a3749c66f65d247d8a6fae1be26d3ef9
SHA1

c394464bba56e62ddfe2c9073932fb656fb78b6c
SHA256

d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c
SHA512

65bc1dba7e4de098e6b27b13b1e0723f703f645e4a4c6e53b7b03ec096a70d48ec2aca7e8bcd911ced61bab35e95983510604421ef35a593278414bfbb1cb01c

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

sodinokibi.exe

pid process

1388 sodinokibi.exe

pid	process
1388	sodinokibi.exe

C:\Users\Admin\AppData\Local\Temp\sodinokibi.exe
"C:\Users\Admin\AppData\Local\Temp\sodinokibi.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1388

memory/1388-55-0x0000000075B71000-0x0000000075B73000-memory.dmp

Filesize
8KB

Download
memory/1388-57-0x0000000000630000-0x00000000006CF000-memory.dmp

Filesize
636KB

Download
memory/1388-59-0x0000000000070000-0x000000000007A000-memory.dmp

Filesize
40KB

Download
memory/1388-60-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1388-61-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/1388-62-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/1388-58-0x0000000002470000-0x000000000259D000-memory.dmp

Filesize
1.2MB

Download
memory/1388-63-0x0000000000270000-0x000000000028F000-memory.dmp

Filesize
124KB

Download
memory/1388-64-0x00000000026B0000-0x00000000027B9000-memory.dmp

Filesize
1.0MB

Download
memory/1388-65-0x00000000000B0000-0x00000000000B6000-memory.dmp

Filesize
24KB

Download