282e5f423623966e407747d3619f8af7dd8d267f73fa5dc48aceb48f7c7a869d | Triage

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 21:09

Sharing

Report Analysis Logs

General

Target

979be819a64a5a544606a93395b0ed43.exe
Size

16KB
MD5

979be819a64a5a544606a93395b0ed43
SHA1

9a7e0af1498bf88722de3575898c0489f7be3c12
SHA256

282e5f423623966e407747d3619f8af7dd8d267f73fa5dc48aceb48f7c7a869d
SHA512

9f6f4357a2045c4ac03dc83703356268738e6e48b656e5eba1691e3046db14cc60bd3fd971c9cfeafeb3e28d38e53d36a4ff30802b3995921f1899ac51f62e36
SSDEEP

384:a5xpAzlq9P0Q/jLHksDbf8rvtQVUkAz0bg:IAzlq+Q7DkwmGVs+

Score

1^/10

Malware Config

Signatures

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3884	979be819a64a5a544606a93395b0ed43.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 3428	3884	979be819a64a5a544606a93395b0ed43.exe	35

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3428
- C:\Users\Admin\AppData\Local\Temp\979be819a64a5a544606a93395b0ed43.exe
  "C:\Users\Admin\AppData\Local\Temp\979be819a64a5a544606a93395b0ed43.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3884-0-0x0000000013140000-0x000000001314B000-memory.dmp

Filesize
44KB

Download