11ce1f90ec12bd68c3c04616d6b5532d333a6567a080d234dfc3c46ae71a11bc | Triage

Analysis

max time kernel
141s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2024, 10:53

Sharing

Report Analysis Logs

General

Target

86b6156da4806bf9ac1c53a67d820358.exe
Size

36KB
MD5

86b6156da4806bf9ac1c53a67d820358
SHA1

c96e23797a5fb1ee1d61cef0eb97f4258d905fd4
SHA256

11ce1f90ec12bd68c3c04616d6b5532d333a6567a080d234dfc3c46ae71a11bc
SHA512

6b23a70a80de3fd889dfa94e6b320aced1745f2bb2fc412f594112a771b017737c3d8d3657d77b4f08765282970c66feafbdea8cd4e9c748ccaff6cc952ea006
SSDEEP

384:cHP1qaBKxCd7PpLjzKb29lKDYyKsez8/tU:cHPdBKYXx48zso8/tU

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 4536	3980	86b6156da4806bf9ac1c53a67d820358.exe	84
PID 3980 wrote to memory of 4536	3980	86b6156da4806bf9ac1c53a67d820358.exe	84
PID 3980 wrote to memory of 4536	3980	86b6156da4806bf9ac1c53a67d820358.exe	84

C:\Users\Admin\AppData\Local\Temp\86b6156da4806bf9ac1c53a67d820358.exe
"C:\Users\Admin\AppData\Local\Temp\86b6156da4806bf9ac1c53a67d820358.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\WINDOWS\system32\hdrwbvhvrv.sd,mymain
  2⤵
  PID:4536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads