Analysis

  • max time kernel
    172s
  • max time network
    182s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 16:07

General

  • Target

    2bd01af687fd2ef3cce723fffe1dee58.exe

  • Size

    115KB

  • MD5

    2bd01af687fd2ef3cce723fffe1dee58

  • SHA1

    af60bf73acbaf4b5f0b15848eea175cf6ac1610a

  • SHA256

    e2b23cf7aca7d324a9b986756f502b40c00db6a64bc9487cad2af2021f21277a

  • SHA512

    d085a0904b35aeb7a0196e1f4b8ae3cf6d95baec042a35bf40d10be7e2633c4951529ee59407fdf5655469cbb4338de017be8365f497738cffdc0dc71db44536

  • SSDEEP

    3072:RhiHcNdjLUZC9lrwhKCzYFhq12soGe6HpSPD8mxC7:8ejLaC9lsMvqM3Ge6I7I

Score
1/10

Malware Config

Signatures

  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2bd01af687fd2ef3cce723fffe1dee58.exe
    "C:\Users\Admin\AppData\Local\Temp\2bd01af687fd2ef3cce723fffe1dee58.exe"
    1⤵
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:4076
    • C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      2⤵
        PID:4984

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4076-0-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/4076-1-0x00000000022E0000-0x00000000022E2000-memory.dmp

      Filesize

      8KB

    • memory/4076-2-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB

    • memory/4076-3-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB

    • memory/4076-4-0x0000000002370000-0x000000000237E000-memory.dmp

      Filesize

      56KB