Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
09/04/2024, 19:48
General
-
Target
71112cfb3fc619e70939e7f07dfccc38.exe
-
Size
431KB
-
MD5
71112cfb3fc619e70939e7f07dfccc38
-
SHA1
aa2c63de85e0b8dc1e1e2a43415382a5dae0e481
-
SHA256
9e540f108e1c383ba1e4c8ae0d9a9d5d92d00e483f1efb2573a1cc54e0593be1
-
SHA512
756778fc5bb50432d845e3cbf510793b0ab0c25f26b2d313b5c148be368fc3257bab9ca43cf03261f8eef8040a354e32eb01f5a71c07079990f4403a9b919cbc
-
SSDEEP
12288:PqvEEu0036Qgo74NcIQOE7EvoKlSql4ejAAWxe1X7BMPpqeepz4eeriQ/ANB:orugiWcIdGEvoKlSql4ejrWx4X7BMPpQ
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\71112cfb3fc619e70939e7f07dfccc38.exe"C:\Users\Admin\AppData\Local\Temp\71112cfb3fc619e70939e7f07dfccc38.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\71112cfb3fc619e70939e7f07dfccc38.exeC:\Users\Admin\AppData\Local\Temp\71112cfb3fc619e70939e7f07dfccc38.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
431KB
MD5ca78c1f4821e03bf54f5fd3f06261173
SHA1b9181d517387e88fa28c9ee840ea8bedbb1234ed
SHA2561008dfb61b611b3a650cbc6e14183dca0917360835006738d2dfcb5968e103b2
SHA5125a5903f6150ddcd79a5c1393cfe437514603ac85975745554d6b653fd6924418238cc88ce78f1a27539f57e817ff9506d15b7799722fcac85fe50badcc50574f
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
104KB
-
Filesize
256KB
-
Filesize
256KB