5c28511a37fa39869f2d6fef6f8e9c8e282216823ec401803b649d9b79b84260 | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 12:54

Sharing

Report Analysis Logs

General

Target

runtime/handle.exe
Size

413KB
MD5

50c128c5b28237b3a01afbdf0e546245
SHA1

7dffdfde2856d2dbd21f54af16edd9cc3447cb6f
SHA256

4690b6fca6898297eb31259c7fad2edaea5308ff8628c12c4586c5fc9902247e
SHA512

6ac8aa872afcde96833e9b347db8765aac0378231c0a920781a14d1d4a79ed3bc1ff1a7cd6b2ac3f7e03c43208c6d2b77b75649497a4d0bea611c22ca54e90ff
SSDEEP

6144:Gzhmwu/RyL8heQcnyRE11ulyhCs2VSP0N3+mUinHv6AcNkqJGLrVU5B:cw/ULVQw1J2eOvAG3K5B

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2240	handle64.exe
1204	Process not Found

Loads dropped DLL 1 IoCs

pid	Process
1740	handle.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2240	1740	handle.exe	29
PID 1740 wrote to memory of 2240	1740	handle.exe	29
PID 1740 wrote to memory of 2240	1740	handle.exe	29
PID 1740 wrote to memory of 2240	1740	handle.exe	29

C:\Users\Admin\AppData\Local\Temp\runtime\handle.exe
"C:\Users\Admin\AppData\Local\Temp\runtime\handle.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Users\Admin\AppData\Local\Temp\runtime\handle64.exe
  "C:\Users\Admin\AppData\Local\Temp\runtime\handle.exe"
  2⤵
  - Executes dropped EXE
  PID:2240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\runtime\handle64.exe

Filesize
219KB

MD5
21b55254e330a0bd0da40e2805372b5e

SHA1
352006989e52b54ad0a3789b71c6ceaeaab9867c

SHA256
4e9317e8b5fcdf7df0ec43e34ee982d3f3098fcdd807df93dfe132366ba06eaa

SHA512
7573e28a2d2fc1b616c76454a4e5ba5fb97caf2d1cf2f9926ef1501636c028557e7d5cfec585d9e01ec76b196531a58e80516b20209715a4b30531e4efbe0d6f

Download Submit