211c37d00b6555ca57c72c779220f31fdb21394436066991149c604487b44991 | Triage

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 10:21

Sharing

Report Analysis Logs

General

Target

MeMeLiveShow.exe
Size

992KB
MD5

f8c15dc56faffdc96995129c1a30c794
SHA1

cbe00d7f50b596b9c958fc951b64da30e283d6e6
SHA256

f85049ff4a1acde8021902fa51b7d7f3bd42df8ce9b8c3be49362516cbe7a2b5
SHA512

45ae09c9b604a9c6d9ba3afdf5f145ff2c73a9f96f7e2cdf7c9832a3629f93e1086bfec98d8c4001a8c7be3f39977b62178ce08baa05db9ca0b5f3f18b68be0b
SSDEEP

12288:Ol3ijfv4KJukIisIqt+Rc6Da0y38weB2hynO:Ol36X4Kv58+Rc6Ds3UBtO

Score

1^/10

Malware Config

Signatures

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

MeMeLiveShow.exe

pid process

3480 MeMeLiveShow.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

MeMeLiveShow.exe

pid process

3480 MeMeLiveShow.exe

C:\Users\Admin\AppData\Local\Temp\MeMeLiveShow.exe
"C:\Users\Admin\AppData\Local\Temp\MeMeLiveShow.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4352 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:3780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...