5c28511a37fa39869f2d6fef6f8e9c8e282216823ec401803b649d9b79b84260 | Triage

Analysis

max time kernel
136s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 12:54

Sharing

Report Analysis Logs

General

Target

runtime/handle.exe
Size

413KB
MD5

50c128c5b28237b3a01afbdf0e546245
SHA1

7dffdfde2856d2dbd21f54af16edd9cc3447cb6f
SHA256

4690b6fca6898297eb31259c7fad2edaea5308ff8628c12c4586c5fc9902247e
SHA512

6ac8aa872afcde96833e9b347db8765aac0378231c0a920781a14d1d4a79ed3bc1ff1a7cd6b2ac3f7e03c43208c6d2b77b75649497a4d0bea611c22ca54e90ff
SSDEEP

6144:Gzhmwu/RyL8heQcnyRE11ulyhCs2VSP0N3+mUinHv6AcNkqJGLrVU5B:cw/ULVQw1J2eOvAG3K5B

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3092	handle64.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 3092	3960	handle.exe	91
PID 3960 wrote to memory of 3092	3960	handle.exe	91

C:\Users\Admin\AppData\Local\Temp\runtime\handle.exe
"C:\Users\Admin\AppData\Local\Temp\runtime\handle.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Users\Admin\AppData\Local\Temp\runtime\handle64.exe
  "C:\Users\Admin\AppData\Local\Temp\runtime\handle.exe"
  2⤵
  - Executes dropped EXE
  PID:3092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\runtime\handle64.exe

Filesize
219KB

MD5
21b55254e330a0bd0da40e2805372b5e

SHA1
352006989e52b54ad0a3789b71c6ceaeaab9867c

SHA256
4e9317e8b5fcdf7df0ec43e34ee982d3f3098fcdd807df93dfe132366ba06eaa

SHA512
7573e28a2d2fc1b616c76454a4e5ba5fb97caf2d1cf2f9926ef1501636c028557e7d5cfec585d9e01ec76b196531a58e80516b20209715a4b30531e4efbe0d6f

Download Submit