3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3 | Triage

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08-04-2024 13:23

Sharing

Report Analysis Logs

General

Target

wininit.exe
Size

1.3MB
MD5

290102d5e403f9eb6d7cd7fe3188d307
SHA1

bac36c2536721592ebcac74a88c50b00fab67e5a
SHA256

3610a513abb50127c22a6c5d2c84b814a5743ba2de685c031725601a23f3bdc3
SHA512

9f8f0ba6d4c81541a2aa55a3f5c5d63eaab1fe1dca8c98e26e4c605b5dc4ce734dff6656f139cbac73c0d753939964af28dc5f2b0d09e03da4361dc65f35a556
SSDEEP

24576:6AHnh+eWsN3skA4RV1Hom2KXMmHal8/L5Sq6C/pWPxGgp5:Nh+ZkldoPK8Yal8FS5j

Score

1^/10

Malware Config

Signatures

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

wininit.exe

pid process

1364 wininit.exe
1364 wininit.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

wininit.exe

pid process

1364 wininit.exe
1364 wininit.exe

C:\Users\Admin\AppData\Local\Temp\wininit.exe
"C:\Users\Admin\AppData\Local\Temp\wininit.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1364

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1364-10-0x0000000000160000-0x0000000000164000-memory.dmp

Filesize
16KB

Download