c63c7e5bd0e8fab5b95b12bed80eec09fec5a7f6d97ba8e9cf848585e48bd626 | Triage

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13-02-2024 01:25

Sharing

Report Analysis Logs

General

Target

981ff079521712e00262c81ea394be80.exe
Size

7KB
MD5

981ff079521712e00262c81ea394be80
SHA1

92ae5f4562bec4804d0c956f25d71f7c84811cf3
SHA256

c63c7e5bd0e8fab5b95b12bed80eec09fec5a7f6d97ba8e9cf848585e48bd626
SHA512

4bdd5c9f7f2b36616057354c60056b204e1a733065e3ee66d656825df9e2fc901509d6f692b4d96798702bc4b29d2f70bd0cd66343a0ed9e0b4a0f566f51be7c
SSDEEP

192:vDnRsZHC+UkoRGXwPHU1o2u+dkmpTckKP23Rr:bnRkFzXwPKvdbt3h

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1836	981ff079521712e00262c81ea394be80.exe
1836	981ff079521712e00262c81ea394be80.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1836	981ff079521712e00262c81ea394be80.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 3360	1836	981ff079521712e00262c81ea394be80.exe	33
PID 1836 wrote to memory of 3360	1836	981ff079521712e00262c81ea394be80.exe	33

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3360
- C:\Users\Admin\AppData\Local\Temp\981ff079521712e00262c81ea394be80.exe
  "C:\Users\Admin\AppData\Local\Temp\981ff079521712e00262c81ea394be80.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1836-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3360-0-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download