f9cf4a8d0467fd62f94d3f88f6003c673313b300d49628a5139542d7254dadf6 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 09:29

Sharing

Report Analysis Logs

General

Target

745611ae49281fb3c19e0bbbe7f355fc.exe
Size

39KB
MD5

745611ae49281fb3c19e0bbbe7f355fc
SHA1

cbd8a6342c57511958866251951bf6271b54de38
SHA256

f9cf4a8d0467fd62f94d3f88f6003c673313b300d49628a5139542d7254dadf6
SHA512

4e0639169f2dda1cb3e9b54987459ac03f4c8f749125fc0936e3ea3e6015fa7a1e4cfc5cdc33347a068eb657e787f2404bacda3db74c9ee3bf93ab7bd6e10806
SSDEEP

768:LUfiwHghryEH/qs9be+7nyWXjgantS8YzXBd:LUfiw+r5C2be+N8YUFrT

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2928	745611ae49281fb3c19e0bbbe7f355fc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 1340	2928	745611ae49281fb3c19e0bbbe7f355fc.exe	7
PID 2928 wrote to memory of 1340	2928	745611ae49281fb3c19e0bbbe7f355fc.exe	7
PID 2928 wrote to memory of 1340	2928	745611ae49281fb3c19e0bbbe7f355fc.exe	7
PID 2928 wrote to memory of 1340	2928	745611ae49281fb3c19e0bbbe7f355fc.exe	7
PID 2928 wrote to memory of 1340	2928	745611ae49281fb3c19e0bbbe7f355fc.exe	7
PID 2928 wrote to memory of 1340	2928	745611ae49281fb3c19e0bbbe7f355fc.exe	7

C:\Users\Admin\AppData\Local\Temp\745611ae49281fb3c19e0bbbe7f355fc.exe
"C:\Users\Admin\AppData\Local\Temp\745611ae49281fb3c19e0bbbe7f355fc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2928

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1340-0-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download
memory/1340-8-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

Filesize
24KB

Download
memory/2928-1-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2928-2-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download