92949d51b75bca01bad3a86ac52013461813eda30539b2f9caf493db250789f0 | Triage

Analysis

max time kernel
140s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 13:40

Sharing

Report Analysis Logs

General

Target

410289ff1cc92f8e35866cc88c1a2999.exe
Size

16KB
MD5

410289ff1cc92f8e35866cc88c1a2999
SHA1

84ba8fb95d5b6f4357d2f4fe6946332e7148244c
SHA256

92949d51b75bca01bad3a86ac52013461813eda30539b2f9caf493db250789f0
SHA512

4fca9af54351cc3b430e970d27bb5db2b1a7457b04744bb206d65ade453dd01c8190592784c57af652829f1aade93527bd244cab35c3cd2de205aa515ff68bcf
SSDEEP

96:kbtxkH+eSUsfeRQWNGggKYROaHJRayo+WMiPH0PtboynN:wtxa+Jf2L2iPH0P1oyn

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\sjis_ext.nls	410289ff1cc92f8e35866cc88c1a2999.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 3144	3076	410289ff1cc92f8e35866cc88c1a2999.exe	91
PID 3076 wrote to memory of 3144	3076	410289ff1cc92f8e35866cc88c1a2999.exe	91
PID 3076 wrote to memory of 3144	3076	410289ff1cc92f8e35866cc88c1a2999.exe	91

C:\Users\Admin\AppData\Local\Temp\410289ff1cc92f8e35866cc88c1a2999.exe
"C:\Users\Admin\AppData\Local\Temp\410289ff1cc92f8e35866cc88c1a2999.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\system32\teamozy.dll,_StartRun@16
  2⤵
  PID:3144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads