Extracted

• • Target

    4460-132-0x0000000000E70000-0x0000000000E90000-memory.dmp

  • Size

    128KB

  • MD5

    db1d7d815156b77233cbd2eb24559b68

  • SHA1

    e999f5b293568487415a69f0ba3682f1205e77c4

  • SHA256

    5241e7dbe8dbb2467f37d64d0b1b8be6783f1e7f551bc7f0b942f54ce8625926

  • SHA512

    92facaf2da5fe448f0a9e0197e6896750b18d2532a999a34d1c62224ea432585e483cbb23326f92fcc5861ca119892d4d70440f68ccde2a574a8fd4f751f49ce

  • SSDEEP

    768:rH8kLBwW59VRjB/jZRj0tZYgU1l50AyDu88+a4:rckLBz59/gU1M8+a4

  Score

  8^/10

  microsoftpersistencephishing

  • Sets file execution options in registry

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Registers COM server for autorun

    persistence

  • Adds Run key to start application

    persistence

  • Detected potential entity reuse from brand microsoft.

    phishingmicrosoft
  behavioral1behavioral2