Analysis
-
max time kernel
600s -
max time network
459s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
20-04-2024 07:35
General
-
Target
fpsunlocker.exe
-
Size
666KB
-
MD5
f0c71376e55ba3c65942e90348169921
-
SHA1
239085aa264e9eb743dde706231169820c32e03c
-
SHA256
94f4140b6e7c3e73364205829da26479dad5257752c009dca4dec4a6ce9f9637
-
SHA512
4ce20f764aac880362fbf9f9ade18c89e19eaa697e73cb08ce37b2eb25b3b655ec569de180c33ded00ca42147dd2c84d21b837224b318d56f258a6e881b6057f
-
SSDEEP
12288:4KOjJsDc2+WC+D+4H/xeGofENaTSuGCC709:4KyacgDD+4fwG1NaTSw
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fpsunlocker.exe"C:\Users\Admin\AppData\Local\Temp\fpsunlocker.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/216-12-0x00000220EE760000-0x00000220EE770000-memory.dmpFilesize
64KB
-
memory/216-28-0x00000220EE860000-0x00000220EE870000-memory.dmpFilesize
64KB
-
memory/216-44-0x00000220F6BD0000-0x00000220F6BD1000-memory.dmpFilesize
4KB
-
memory/216-46-0x00000220F6C00000-0x00000220F6C01000-memory.dmpFilesize
4KB
-
memory/216-47-0x00000220F6C00000-0x00000220F6C01000-memory.dmpFilesize
4KB
-
memory/216-48-0x00000220F6D10000-0x00000220F6D11000-memory.dmpFilesize
4KB