4d535dc7549bcee677eecbccac1820138801e77ded07e9d1bc69acce640e61ce | Triage

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 16:51

Sharing

Report Analysis Logs

General

Target

2e91952f34c78a0f4260a4a26d4170af.exe
Size

112KB
MD5

2e91952f34c78a0f4260a4a26d4170af
SHA1

03f04f8ccf434f6fdb240f5dbcad4b12fb64a9ab
SHA256

4d535dc7549bcee677eecbccac1820138801e77ded07e9d1bc69acce640e61ce
SHA512

8d69a29f032726b1a8ac913d8bf3ba3b641de85ddb45dd2a863cd4cdfddd138a20f352da74ad1b4d353d1b6407ee586e1fcc1678eb472f2e72a99943bb6964bd
SSDEEP

3072:OOxOwERTC7kus+jSfyTA0pTCib96VWQx1zeZN:OCutC7NIfyTZkzeD

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 3264	3632	2e91952f34c78a0f4260a4a26d4170af.exe	18
PID 3632 wrote to memory of 3264	3632	2e91952f34c78a0f4260a4a26d4170af.exe	18
PID 3632 wrote to memory of 3264	3632	2e91952f34c78a0f4260a4a26d4170af.exe	18

C:\Users\Admin\AppData\Local\Temp\2e91952f34c78a0f4260a4a26d4170af.exe
"C:\Users\Admin\AppData\Local\Temp\2e91952f34c78a0f4260a4a26d4170af.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Users\Admin\AppData\Local\Temp\2e91952f34c78a0f4260a4a26d4170af.exe
  "C:\Users\Admin\AppData\Local\Temp\2e91952f34c78a0f4260a4a26d4170af.exe"
  2⤵
  PID:3264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3632-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3632-1-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download