ad9d1d2c8db7cc0b400cd49555dc39d2c0c13fa74784f007f5177163bf480176 | Triage

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-03-2024 18:33

Sharing

Report Analysis Logs

General

Target

b5632339a5359f451b6ad0d68b2e6cb8.exe
Size

865KB
MD5

b5632339a5359f451b6ad0d68b2e6cb8
SHA1

bb37229b4be212a96773fcfa152ef9edacd9b203
SHA256

ad9d1d2c8db7cc0b400cd49555dc39d2c0c13fa74784f007f5177163bf480176
SHA512

93d73f2853038ba479e6fac47a9ebb0a9ec22a465a3ecaf3f1d002e51d3cf0dd1cc19d5e08c8c1ab46a5594e0138dce5ea513a41dbcecb64fb84513bfcc22da0
SSDEEP

24576:T9OTg+jR8EkHk9wZeDUJ5M5uClZXoVVmacP:kTgNE0ZiUJ5wZAVk

Score

1^/10

Malware Config

Signatures

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1852	b5632339a5359f451b6ad0d68b2e6cb8.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 1380	1852	b5632339a5359f451b6ad0d68b2e6cb8.exe	93
PID 1852 wrote to memory of 1380	1852	b5632339a5359f451b6ad0d68b2e6cb8.exe	93
PID 1852 wrote to memory of 1380	1852	b5632339a5359f451b6ad0d68b2e6cb8.exe	93

C:\Users\Admin\AppData\Local\Temp\b5632339a5359f451b6ad0d68b2e6cb8.exe
"C:\Users\Admin\AppData\Local\Temp\b5632339a5359f451b6ad0d68b2e6cb8.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\b5632339a5359f451b6ad0d68b2e6cb8.exe"
  2⤵
  PID:1380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1852-0-0x0000000000B50000-0x0000000000B72000-memory.dmp

Filesize
136KB

Download
memory/1852-1-0x0000000001380000-0x0000000001382000-memory.dmp

Filesize
8KB

Download
memory/1852-2-0x0000000000B50000-0x0000000000B72000-memory.dmp

Filesize
136KB

Download