9941e18aac02eaebce094ea03ef96b439e4674cc49cc0bdb41ca281ab38c43c9 | Triage

Analysis

max time kernel
133s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 22:15

Sharing

Report Analysis Logs

General

Target

jinshancibanlixianbao_3987/PowerWord.800.12012.exe
Size

25.4MB
MD5

a09464be22c0bdecede3930a6e26fe10
SHA1

e943e24ec047d18ba5ebeff5b108b465ea7dfa80
SHA256

8af80742af434a0f85a53086993c31acae4ff58b4f3053872b316d04024f4564
SHA512

5dc325ce0a157477e1d57fbc2fdc6da084cb71700078e6387b7ac4b9cf1306ed0cee3bfc511d5ecfd357a1cda9a4fd4cd9970341ca8a6c61241c16ebb3e69174
SSDEEP

786432:tjYfRngSiR7uSO1Pk2v9ltaD9/jiXCb5:tjSbtTYx7qCl

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5356	PowerWord.800.12012.exe

C:\Users\Admin\AppData\Local\Temp\jinshancibanlixianbao_3987\PowerWord.800.12012.exe
"C:\Users\Admin\AppData\Local\Temp\jinshancibanlixianbao_3987\PowerWord.800.12012.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:5356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5356-35-0x00000000047B0000-0x00000000047B1000-memory.dmp

Filesize
4KB

Download
memory/5356-42-0x00000000047B0000-0x00000000047B1000-memory.dmp

Filesize
4KB

Download