Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
26/01/2024, 03:33
General
-
Target
7646d36e40c83c478f43ce050477ec41.exe
-
Size
5.8MB
-
MD5
7646d36e40c83c478f43ce050477ec41
-
SHA1
851f08b1e6c05250ae8a2328830a48c26c7469ab
-
SHA256
30032c46f3f72769a1d4927bc89d10e6a19097134d8c18650194ec2caa1cd957
-
SHA512
98faa3a5c3be2f05b98e24a31691af2b0d1009100018aed3023f0094bd96285857157bfe25a00b5f78083d9d0aa9612382fad080e7ce1ac6021d33ea862493fd
-
SSDEEP
98304:oEZDtYwttYSCtYwttYXc6tYwttYSCtYwttYFvtYwttYSCtYwttYXc6tYwttYSCt5:oEFtjt9CtjtqTtjt9CtjtQtjt9CtjtqE
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7646d36e40c83c478f43ce050477ec41.exe"C:\Users\Admin\AppData\Local\Temp\7646d36e40c83c478f43ce050477ec41.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7646d36e40c83c478f43ce050477ec41.exeC:\Users\Admin\AppData\Local\Temp\7646d36e40c83c478f43ce050477ec41.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.8MB
MD5390673df6331003764946df01c66615c
SHA1a890c095a045eeefb9c940f313dbaaac6ee36cd7
SHA2569225767af92bc8e364f1abaeb6319d2e31f88dc41a959d4b530259b6a80209e9
SHA5129246b0db7fbd65216dfd9af724721c2b53eff7b22872f715c63710ed01432bfab8fc02d8bf13a4dfcc9ebdc480b3561219089c20881bcf711a5ec8b6d3501ae2
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
104KB