139ab5b62369fcbeba601c850703e5a2214e7a61507c824dc68657f8b94a7caa | Triage

Analysis

max time kernel
144s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2024 00:58

Sharing

Report Analysis Logs

General

Target

78db2e5dca95ef74fea854b17e7508f7.exe
Size

676KB
MD5

78db2e5dca95ef74fea854b17e7508f7
SHA1

63c4613e6d383b7084997de04b5b1d6532368ae3
SHA256

139ab5b62369fcbeba601c850703e5a2214e7a61507c824dc68657f8b94a7caa
SHA512

a76fb2abe901ce78bfcd962ce2076252c86a5763d84e52dedd95ab9f484e54dce706e2e9e78e4b364a15d5b42d0df4bba22902a5668dca34b982cb33866b4479
SSDEEP

12288:b3+RRe9cVVcvk7AvhNpDZWRKdGG0jpRIsgR93:qRRe9cVXAZNrWRjPIsgr3

Score

1^/10

Malware Config

Signatures

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4492	78db2e5dca95ef74fea854b17e7508f7.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 1720	4492	78db2e5dca95ef74fea854b17e7508f7.exe	87
PID 4492 wrote to memory of 1720	4492	78db2e5dca95ef74fea854b17e7508f7.exe	87
PID 4492 wrote to memory of 1720	4492	78db2e5dca95ef74fea854b17e7508f7.exe	87

C:\Users\Admin\AppData\Local\Temp\78db2e5dca95ef74fea854b17e7508f7.exe
"C:\Users\Admin\AppData\Local\Temp\78db2e5dca95ef74fea854b17e7508f7.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Users\Admin\AppData\Local\Temp\78db2e5dca95ef74fea854b17e7508f7.exe
  "C:\Users\Admin\AppData\Local\Temp\78db2e5dca95ef74fea854b17e7508f7.exe"
  2⤵
  PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4492-2-0x0000000002E20000-0x0000000002E22000-memory.dmp

Filesize
8KB

Download
memory/4492-1-0x0000000001000000-0x0000000001100000-memory.dmp

Filesize
1024KB

Download