Overview

overview

3

Static

static

3

116a8e65db...15.exe

windows7-x64

1

116a8e65db...15.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-05-2024 01:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    116a8e65db201fd329ac14402254202e47314e0f310788948368e75dc9580115.exe

  • Size

    12KB

  • MD5

    73a82f11b119b3b68161c385d3b21ce1

  • SHA1

    3022ea9d1fb93fba84ae31bfcd843c48baaa89a2

  • SHA256

    116a8e65db201fd329ac14402254202e47314e0f310788948368e75dc9580115

  • SHA512

    fa2f67642930dc534360d0c5ab8294d7bfef22dd9332e72d74017130c0cb26ae25b5b0dd528d9d545e440ddaa4a9f61392d13189168978a10394aaadbe20a2cb

  • SSDEEP

    192:RFBkm/S1R0XLQeFwUxifpoVGxcMR8DdkTYfJMULz9MQ1d:NB/HblJ0+Vq3uaoyA9M

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\116a8e65db201fd329ac14402254202e47314e0f310788948368e75dc9580115.exe
    "C:\Users\Admin\AppData\Local\Temp\116a8e65db201fd329ac14402254202e47314e0f310788948368e75dc9580115.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4632
    • C:\ProgramData\pcdfdata\116a8e65db201fd329ac14402254202e47314e0f310788948368e75dc9580115.exe
      C:\ProgramData\pcdfdata\116a8e65db201fd329ac14402254202e47314e0f310788948368e75dc9580115.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4632-0-0x0000000000550000-0x0000000000557000-memory.dmp

    Filesize

    28KB

    Download