0ab0116b34db0e7168dd5c5b1c917bbb1d38235ece4430348f068914b4ab87a6 | Triage

Analysis

max time kernel
454s
max time network
1175s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
04-06-2024 17:18

Sharing

Report Analysis Logs

General

Target

procexp.exe
Size

4.4MB
MD5

7289aa6c0f2c41c29c9b33caf1c15779
SHA1

96387ab157168b22111e3c70b22364c9b71639c4
SHA256

0ab0116b34db0e7168dd5c5b1c917bbb1d38235ece4430348f068914b4ab87a6
SHA512

f98d4541a31df87e80a8dbce0c783585f9b471a0388bf179b8c3cfaf65366212349b059a17a7b6d1c5704a86c6af5184f0b9c5d99e590a6a1a60dae943300d0b
SSDEEP

49152:Kug+zejoF8v8F/nluLRpSct4whtfVKevv7m9gcQYPbH51a7y58SG:Nzeo80F/nQRMPbjAyKZ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
456	procexp64.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 456	5068	procexp.exe	76
PID 5068 wrote to memory of 456	5068	procexp.exe	76

C:\Users\Admin\AppData\Local\Temp\procexp.exe
"C:\Users\Admin\AppData\Local\Temp\procexp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Users\Admin\AppData\Local\Temp\procexp64.exe
  "C:\Users\Admin\AppData\Local\Temp\procexp.exe"
  2⤵
  - Executes dropped EXE
  PID:456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\procexp64.exe

Filesize
2.3MB

MD5
a0773a1a0102cfe56855b95b654ff400

SHA1
809fc843f89a49f3a56c8d8552e3fd6d1fa1bebe

SHA256
35bd4e71b67655192a2b5159e7a7303d8332cd81df2842bf2679d92adbf57e25

SHA512
9ff45c55338300f0f47219732a0252a856f305000f22955f1e6207ec131d8896f7564c621864ecec4228a488e786cad5e1a127230e60f031a83072c988c73d47

Download Submit