89f3641d7cb31f7755fd8d74d293c4e36f1e24a198c864a5b2b8d53e86f5f23b | Triage

Analysis

max time kernel
93s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 03:10

Sharing

Report Analysis Logs

General

Target

e8462572c325e8ce44d52237af164270.exe
Size

387KB
MD5

e8462572c325e8ce44d52237af164270
SHA1

728be6dfb105688d723d7e85d346669a45abd275
SHA256

89f3641d7cb31f7755fd8d74d293c4e36f1e24a198c864a5b2b8d53e86f5f23b
SHA512

04eaabce1622f84bf970280860382fb1d33348567698d799d8616c4f8d5e5140035f56800bb1a5d2ef336cd4fbc3c68380089c038b55243f66e9a7e42d899143
SSDEEP

12288:SplrVbDdQaqdS/ofraFErH8uB2Wm0SXsNr5FU:exRQ+Fucuvm0as

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3516	Documentation.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\within\Documentation.exe	e8462572c325e8ce44d52237af164270.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4084	e8462572c325e8ce44d52237af164270.exe
4084	e8462572c325e8ce44d52237af164270.exe
4084	e8462572c325e8ce44d52237af164270.exe
4084	e8462572c325e8ce44d52237af164270.exe
3516	Documentation.exe
3516	Documentation.exe
3516	Documentation.exe
3516	Documentation.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 3516	4084	e8462572c325e8ce44d52237af164270.exe	86
PID 4084 wrote to memory of 3516	4084	e8462572c325e8ce44d52237af164270.exe	86
PID 4084 wrote to memory of 3516	4084	e8462572c325e8ce44d52237af164270.exe	86

C:\Users\Admin\AppData\Local\Temp\e8462572c325e8ce44d52237af164270.exe
"C:\Users\Admin\AppData\Local\Temp\e8462572c325e8ce44d52237af164270.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Program Files\within\Documentation.exe
  "C:\Program Files\within\Documentation.exe" "33201"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\within\Documentation.exe

Filesize
387KB

MD5
50e72f29fb627bea4b6ad1f13a5c3e9b

SHA1
9189c114900d2e6544db57b6f9250cbbd0d1e9c5

SHA256
b0638859f1a2974bc8daa85daa91fded3b0b4842aba29b1c6b4d1bdc1051fa39

SHA512
f10c6be29235b5c19731a73469ecb18c3e9e8a001c54d71ca5e678ff55067187fa38f37eb9a15cca4edfa56dc0aa482bd42491b5995653dcbcbe3dc83d803cb6

Download Submit