6503af884f87235c82c36b47fd40fc0cc61dc82aa479c0f3196c3a0b97209886 | Triage

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07/02/2023, 13:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

12.4MB
MD5

3e2c3e5f1519583f450f2c658720de0f
SHA1

5a85dc4aad7894eb1d2e522c17ec6cf489b36dec
SHA256

6503af884f87235c82c36b47fd40fc0cc61dc82aa479c0f3196c3a0b97209886
SHA512

4a43da0f3ea058795d4796f4e0794fe524983e2643771d073890a48512554517745dcaa0475173e690a49ba855bf088f93fab9f131711930f7bf3dbbf2a84d5b
SSDEEP

393216:yLF7hgdtdOT0y62yqgJDt1gn/2CuuegmdBXpEXjGD6ApgMyx708OK:yZF+tnDKght8x

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1516	tmp.exe
1516	tmp.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1516	tmp.exe
1516	tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1516-54-0x0000000000400000-0x0000000000E00000-memory.dmp

Filesize
10.0MB

Download
memory/1516-58-0x0000000000400000-0x0000000000E00000-memory.dmp

Filesize
10.0MB

Download