73f92c40f4387ca3c46beaf85eec1c620e148ba34333541f057fb9e909ac176a | Triage

Analysis

max time kernel
146s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 18:18

Sharing

Report Analysis Logs

General

Target

33f375f73ae9d7c76d53be987421e36f.exe
Size

7KB
MD5

33f375f73ae9d7c76d53be987421e36f
SHA1

99a148ca22accf3ebd50282b8f422978ff4c8a02
SHA256

73f92c40f4387ca3c46beaf85eec1c620e148ba34333541f057fb9e909ac176a
SHA512

ee0122a27de29f92f703914393b41764d5f69d04075c192a865f0f02845123312b5a6bb8f71a87b81ba1f4a53b1613314b1676606f1947a81155bfcc593ca318
SSDEEP

192:vDnRsZHC+UkoRGXwPHU1o2u+dkmpTcIVyS76:bnRkFzXwPKvdbZVXW

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2960	33f375f73ae9d7c76d53be987421e36f.exe
2960	33f375f73ae9d7c76d53be987421e36f.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2960	33f375f73ae9d7c76d53be987421e36f.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 3444	2960	33f375f73ae9d7c76d53be987421e36f.exe	29
PID 2960 wrote to memory of 3444	2960	33f375f73ae9d7c76d53be987421e36f.exe	29

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3444
- C:\Users\Admin\AppData\Local\Temp\33f375f73ae9d7c76d53be987421e36f.exe
  "C:\Users\Admin\AppData\Local\Temp\33f375f73ae9d7c76d53be987421e36f.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2960-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3444-0-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download