c6407b48ee4c7dd2191d8c86e5b456d4237a732d18f2a341f32360b27341c0c9 | Triage

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 00:17

Sharing

Report Analysis Logs

General

Target

08491c6d79b19ea01cda1261ab9199b3.exe
Size

84KB
MD5

08491c6d79b19ea01cda1261ab9199b3
SHA1

aa4e815fad88959a7b46f952a3f1dcb8ebd3fd95
SHA256

c6407b48ee4c7dd2191d8c86e5b456d4237a732d18f2a341f32360b27341c0c9
SHA512

305985bd09f61bcc312e08f7e9b511f9cd4d5d77589f705ef8dad76beb3ac657deddc92a9bfb5e998e761cc37a3909d9731a26042393a37315b61c8a68e2a0ac
SSDEEP

1536:qwm8nBjqs32bxPpBRy32Z6gJlyiKqVo6EUA:5m8nBjTmbxRBRN6WYiKqVo6ZA

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\kernel.dll	08491c6d79b19ea01cda1261ab9199b3.exe
File created	C:\Windows\kernel.dll	08491c6d79b19ea01cda1261ab9199b3.exe
File created	C:\Windows\svchost.exe	08491c6d79b19ea01cda1261ab9199b3.exe
File opened for modification	C:\Windows\svchost.exe	08491c6d79b19ea01cda1261ab9199b3.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2008	08491c6d79b19ea01cda1261ab9199b3.exe
2008	08491c6d79b19ea01cda1261ab9199b3.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 3500	2008	08491c6d79b19ea01cda1261ab9199b3.exe	74

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3500
- C:\Users\Admin\AppData\Local\Temp\08491c6d79b19ea01cda1261ab9199b3.exe
  "C:\Users\Admin\AppData\Local\Temp\08491c6d79b19ea01cda1261ab9199b3.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2008-2-0x0000000013140000-0x000000001315B000-memory.dmp

Filesize
108KB

Download