Analysis

  • max time kernel
    125s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-12-2023 23:33

General

  • Target

    96739a4d394217c2cbd895cf16acc0c8.exe

  • Size

    455KB

  • MD5

    96739a4d394217c2cbd895cf16acc0c8

  • SHA1

    90af83fed1eb2652e133aad4f47f9354287f75a8

  • SHA256

    28fe91c48fa8583da9692cbdee3c2c32038d5dc3f8ca7dcd195f74511c1d6a78

  • SHA512

    846383b8cd6ff5208c96bf2063faff5c2fa1c1d5d714c11cb30d9aa84ad56f2435f70b2446cfc7006920a4b71dfc568bb36e03d5e8d077db757e673307729955

  • SSDEEP

    6144:FpJ+LBFdhgY3AgXUU6EEsgg/nzzYjzZnMUzpVltygvxTUpVP/KW+q9UT95GX:vArdGPqSENgg/KRpT/vxUpMLR5k

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\96739a4d394217c2cbd895cf16acc0c8.exe
    "C:\Users\Admin\AppData\Local\Temp\96739a4d394217c2cbd895cf16acc0c8.exe"
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:4052
    • C:\Users\Admin\AppData\Local\Temp\96739a4d394217c2cbd895cf16acc0c8.exe
      "C:\Users\Admin\AppData\Local\Temp\96739a4d394217c2cbd895cf16acc0c8.exe"
      2⤵
        PID:4760

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4052-1-0x0000000001590000-0x0000000001592000-memory.dmp

      Filesize

      8KB

    • memory/4052-2-0x0000000000D50000-0x0000000000D90000-memory.dmp

      Filesize

      256KB

    • memory/4052-0-0x0000000000D50000-0x0000000000D90000-memory.dmp

      Filesize

      256KB