2351a16e7e2950efc2cfa70a73c00d3b280a6c0bf7a000cd5ecd8570cb41e341 | Triage

Analysis

max time kernel
94s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 14:05

Sharing

Report Analysis Logs

General

Target

c0c6664e09d6026b94eaf9adc4c1bb54.exe
Size

3KB
MD5

c0c6664e09d6026b94eaf9adc4c1bb54
SHA1

71e8663244cf37d7979287ae7657084ce3d99b88
SHA256

2351a16e7e2950efc2cfa70a73c00d3b280a6c0bf7a000cd5ecd8570cb41e341
SHA512

cb622644d8cb288760cc237b285a5011db65fe6ed6b496cafc8ccd3d469111c153bb961170db9f19076305d123b0892599c5f9d3bc50f98c8d97fe1801645526

Score

1^/10

Malware Config

Signatures

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2936	c0c6664e09d6026b94eaf9adc4c1bb54.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 3524	2936	c0c6664e09d6026b94eaf9adc4c1bb54.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3524
- C:\Users\Admin\AppData\Local\Temp\c0c6664e09d6026b94eaf9adc4c1bb54.exe
  "C:\Users\Admin\AppData\Local\Temp\c0c6664e09d6026b94eaf9adc4c1bb54.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2936-0-0x0000000031400000-0x0000000031402000-memory.dmp

Filesize
8KB

Download