Extracted

• • Target

    1708-54-0x0000000001320000-0x0000000001340000-memory.dmp

  • Size

    128KB

  • MD5

    cefd3a9529539e46860f29ec2b69cdb3

  • SHA1

    3bbf9ef828fb7402725a0f1d9a97158ba9e70977

  • SHA256

    9ff26d6aa285bee07f9890449a46ab7b1a1673b8544b2f96705dcf0af5a1e410

  • SHA512

    06e856a4b2fb68b2f896d27e9d3c6e37da3f64ef233273e79d51ea7bba08318a5409ef80fe997387956461fd1ac390465997ab327686a2771c50eb424b49b53d

  • SSDEEP

    768:/Z8TLBwW59VRjB/jZRj0tZYgU1l50AyDu88+a4:/6TLBz59/gU1M8+a4

  Score

  8^/10

  microsoftpersistencephishing

  • Sets file execution options in registry

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Registers COM server for autorun

    persistence

  • Adds Run key to start application

    persistence

  • Detected potential entity reuse from brand microsoft.

    phishingmicrosoft
  behavioral1behavioral2