Analysis
-
max time kernel
23s -
max time network
4s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
-
submitted
21-04-2024 22:50
General
-
Target
svhost.exe
-
Size
7.1MB
-
MD5
a947a9e85a01ddbba4a6d4b500b40206
-
SHA1
cea7e63b7c10d4eff1c22be36f93e55907ec9365
-
SHA256
3157201d61d8092c6c989bf96f9e1199b07b2077ff3c1b4025feaa9cf1c4d903
-
SHA512
d97df48058a2439605eb46b6800402e7d909b12383a18b679ffad3a58150aefa76c333c02d1334c20b918cca56a4ccfaec5dab3671575bf7cba7481010b564c8
-
SSDEEP
196608:6Q7R35BJqyZrFRPXYFPOZOYaNzW/4y22:6Q7RJbq+XQslaD
Score
7/10
Malware Config
Signatures
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5020-0-0x00007FF64F890000-0x00007FF65077E000-memory.dmpFilesize
14.9MB
-
memory/5020-1-0x00007FFF092F0000-0x00007FFF092F2000-memory.dmpFilesize
8KB
-
memory/5020-2-0x00007FFF09300000-0x00007FFF09302000-memory.dmpFilesize
8KB
-
memory/5020-3-0x00007FF64F890000-0x00007FF65077E000-memory.dmpFilesize
14.9MB
-
memory/5020-7-0x00007FF64F890000-0x00007FF65077E000-memory.dmpFilesize
14.9MB