Analysis

  • max time kernel
    126s
  • max time network
    181s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-10-2022 14:59

General

  • Target

    8ca5909a3807af0e37b2b9457703dfa71a01f3ff828bb43582118919ae7def40.exe

  • Size

    165KB

  • MD5

    96522a46327cc32174753be6f64617b5

  • SHA1

    d1b89943c44e7bc5e03c4c45ae863e1d650ca044

  • SHA256

    8ca5909a3807af0e37b2b9457703dfa71a01f3ff828bb43582118919ae7def40

  • SHA512

    5799020c06ebdeaf0cf01d92d813268cfa4581b4d118e18aa79b21e0f7a1d0da566f3630f62a6950b15ebd470203e94d66aa923b6eb8cd71a4e9bddd32157bb9

  • SSDEEP

    3072:knCTkb/fk2G43QJbDzKuYtBY8U61LjU2addcvzBteh3QeE5BYMOnVts3aS6e:knCs02G43aDjYtBK61LjU2givzBk/E5d

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:512
      • C:\Users\Admin\AppData\Local\Temp\8ca5909a3807af0e37b2b9457703dfa71a01f3ff828bb43582118919ae7def40.exe
        "C:\Users\Admin\AppData\Local\Temp\8ca5909a3807af0e37b2b9457703dfa71a01f3ff828bb43582118919ae7def40.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4652

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/512-136-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

      Filesize

      28KB

    • memory/4652-132-0x0000000000400000-0x0000000000413A00-memory.dmp

      Filesize

      78KB

    • memory/4652-133-0x0000000000400000-0x0000000000413A00-memory.dmp

      Filesize

      78KB

    • memory/4652-134-0x0000000000400000-0x0000000000413A00-memory.dmp

      Filesize

      78KB

    • memory/4652-135-0x0000000010000000-0x0000000010013000-memory.dmp

      Filesize

      76KB

    • memory/4652-137-0x0000000010000000-0x0000000010013000-memory.dmp

      Filesize

      76KB