Overview

overview

10

Static

static

17453e7215...80.exe

windows7_x64

1

17453e7215...80.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    76s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    25-06-2022 02:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe

  • Size

    840KB

  • MD5

    8a2123d4809ffdc677df37b88d58769c

  • SHA1

    4138f2da78ccf7ed3a07d455fddb367f59568d04

  • SHA256

    17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80

  • SHA512

    632870596e6f41adefce8a6589ee75b9df1ab483e619d2a2e555f6878a48007c5a38267c576ef3b056559d5348994427e46690034a59388aeee910f4fa93f671

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe
    "C:\Users\Admin\AppData\Local\Temp\17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1640
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:364

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1640-54-0x0000000001300000-0x00000000013D8000-memory.dmp
      Filesize

      864KB

      Download
    • memory/1640-55-0x0000000000980000-0x0000000000998000-memory.dmp
      Filesize

      96KB

      Download