86455e8e4776c7f0c1244a22f628742cf9569c0876b952772202228a8172c09e

Analysis

max time kernel
33s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 02:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

86455e8e4776c7f0c1244a22f628742cf9569c0876b952772202228a8172c09e.exe
Size

37KB
MD5

3de2f8c1feb74b2d2b2c2de4824cbaec
SHA1

adfaefe0f2e0827510320e946ab45602533e5097
SHA256

86455e8e4776c7f0c1244a22f628742cf9569c0876b952772202228a8172c09e
SHA512

48b352494db77d147a4d602f977ce07fa400d7f36c68a84b2423d88e336fc443597c0e49d53aaf72524d070f3dc4ff308265915c40594d603e2540de7c3b5038
SSDEEP

384:qWQneNrjcdlgRFiymwicsglGP7verCuns3EEFNA6Kh2OqIV2Rxj6comHduX+1:fSlGmbsCuQ06KhBgxj62d0+1

Score

9^/10

upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/1232-0-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/files/0x0008000000023483-4.dat	UPX
behavioral2/memory/1232-6-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/3068-10-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/2828-15-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/3800-14-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/2768-20-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/2828-19-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/2768-24-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/4108-28-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/4400-33-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/4352-32-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/4112-38-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/4400-37-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/1752-43-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/4112-42-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/1752-47-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/1420-51-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/3304-52-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/536-57-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/3304-56-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/3852-62-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/536-61-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/3976-67-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/3852-66-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/3976-71-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/4784-72-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/4784-76-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/3960-77-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/1852-82-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/3960-81-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/1048-87-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/1852-86-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/1048-91-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/1924-96-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/1540-95-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/2272-101-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/1924-100-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/3952-106-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/2272-105-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/4332-111-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/3952-110-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/1732-116-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/4332-115-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/1732-120-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/3136-125-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/2064-124-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/4976-130-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/3136-129-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/4084-135-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/4976-134-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/4084-139-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/2556-143-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/1616-148-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/2724-147-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/1616-152-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/1956-155-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/2460-154-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/1956-157-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/2836-158-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/4804-161-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/2836-160-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/2504-164-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral2/memory/4804-163-0x0000000000400000-0x000000000040D000-memory.dmp	UPX

Executes dropped EXE 15 IoCs

pid	Process
3068	lanmanwrk.exe
3800	lanmanwrk.exe
2828	lanmanwrk.exe
2768	lanmanwrk.exe
4108	lanmanwrk.exe
4352	lanmanwrk.exe
4400	lanmanwrk.exe
4112	lanmanwrk.exe
1752	lanmanwrk.exe
1420	lanmanwrk.exe
3304	lanmanwrk.exe
536	lanmanwrk.exe
3852	lanmanwrk.exe
3976	lanmanwrk.exe
4784	lanmanwrk.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1232-0-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/files/0x0008000000023483-4.dat	upx
behavioral2/memory/1232-6-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/3068-10-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/2828-15-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/3800-14-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/2768-20-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/2828-19-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/2768-24-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/4108-28-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/4400-33-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/4352-32-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/4112-38-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/4400-37-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/1752-43-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/4112-42-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/1752-47-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/1420-51-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/3304-52-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/536-57-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/3304-56-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/3852-62-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/536-61-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/3976-67-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/3852-66-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/3976-71-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/4784-72-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/4784-76-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/3960-77-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/1852-82-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/3960-81-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/1048-87-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/1852-86-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/1048-91-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/1924-96-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/1540-95-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/2272-101-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/1924-100-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/3952-106-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/2272-105-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/4332-111-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/3952-110-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/1732-116-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/4332-115-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/1732-120-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/3136-125-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/2064-124-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/4976-130-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/3136-129-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/4084-135-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/4976-134-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/4084-139-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/2556-143-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/1616-148-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/2724-147-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/1616-152-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/1956-155-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/2460-154-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/1956-157-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/2836-158-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/4804-161-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/2836-160-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/2504-164-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/4804-163-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\lanmanwrk.exe	lanmanwrk.exe
File created	C:\Windows\SysWOW64\lanmanwrk.exe	lanmanwrk.exe
File created	C:\Windows\SysWOW64\lanmanwrk.exe	lanmanwrk.exe
File opened for modification	C:\Windows\SysWOW64\iexchg.dll	86455e8e4776c7f0c1244a22f628742cf9569c0876b952772202228a8172c09e.exe
File opened for modification	C:\Windows\SysWOW64\iexchg.dll	lanmanwrk.exe
File opened for modification	C:\Windows\SysWOW64\iexchg.dll	lanmanwrk.exe
File opened for modification	C:\Windows\SysWOW64\iexchg.dll	lanmanwrk.exe
File opened for modification	C:\Windows\SysWOW64\iexchg.dll	lanmanwrk.exe
File created	C:\Windows\SysWOW64\lanmanwrk.exe	lanmanwrk.exe
File opened for modification	C:\Windows\SysWOW64\iexchg.dll	lanmanwrk.exe
File created	C:\Windows\SysWOW64\lanmanwrk.exe	lanmanwrk.exe
File opened for modification	C:\Windows\SysWOW64\lanmanwrk.exe	86455e8e4776c7f0c1244a22f628742cf9569c0876b952772202228a8172c09e.exe
File created	C:\Windows\SysWOW64\lanmanwrk.exe	lanmanwrk.exe
File opened for modification	C:\Windows\SysWOW64\iexchg.dll	lanmanwrk.exe
File opened for modification	C:\Windows\SysWOW64\iexchg.dll	lanmanwrk.exe
File created	C:\Windows\SysWOW64\lanmanwrk.exe	lanmanwrk.exe
File opened for modification	C:\Windows\SysWOW64\iexchg.dll	lanmanwrk.exe
File opened for modification	C:\Windows\SysWOW64\iexchg.dll	lanmanwrk.exe
File created	C:\Windows\SysWOW64\lanmanwrk.exe	lanmanwrk.exe
File opened for modification	C:\Windows\SysWOW64\iexchg.dll	lanmanwrk.exe
File created	C:\Windows\SysWOW64\lanmanwrk.exe	86455e8e4776c7f0c1244a22f628742cf9569c0876b952772202228a8172c09e.exe
File opened for modification	C:\Windows\SysWOW64\iexchg.dll	lanmanwrk.exe
File opened for modification	C:\Windows\SysWOW64\iexchg.dll	lanmanwrk.exe
File opened for modification	C:\Windows\SysWOW64\iexchg.dll	lanmanwrk.exe
File opened for modification	C:\Windows\SysWOW64\iexchg.dll	lanmanwrk.exe
File created	C:\Windows\SysWOW64\lanmanwrk.exe	lanmanwrk.exe
File opened for modification	C:\Windows\SysWOW64\iexchg.dll	lanmanwrk.exe
File created	C:\Windows\SysWOW64\lanmanwrk.exe	lanmanwrk.exe
File created	C:\Windows\SysWOW64\lanmanwrk.exe	lanmanwrk.exe
File created	C:\Windows\SysWOW64\lanmanwrk.exe	lanmanwrk.exe
File created	C:\Windows\SysWOW64\lanmanwrk.exe	lanmanwrk.exe
File created	C:\Windows\SysWOW64\lanmanwrk.exe	lanmanwrk.exe
File created	C:\Windows\SysWOW64\lanmanwrk.exe	lanmanwrk.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 3068	1232	86455e8e4776c7f0c1244a22f628742cf9569c0876b952772202228a8172c09e.exe	85
PID 1232 wrote to memory of 3068	1232	86455e8e4776c7f0c1244a22f628742cf9569c0876b952772202228a8172c09e.exe	85
PID 1232 wrote to memory of 3068	1232	86455e8e4776c7f0c1244a22f628742cf9569c0876b952772202228a8172c09e.exe	85
PID 3068 wrote to memory of 3800	3068	lanmanwrk.exe	86
PID 3068 wrote to memory of 3800	3068	lanmanwrk.exe	86
PID 3068 wrote to memory of 3800	3068	lanmanwrk.exe	86
PID 3800 wrote to memory of 2828	3800	lanmanwrk.exe	89
PID 3800 wrote to memory of 2828	3800	lanmanwrk.exe	89
PID 3800 wrote to memory of 2828	3800	lanmanwrk.exe	89
PID 2828 wrote to memory of 2768	2828	lanmanwrk.exe	92
PID 2828 wrote to memory of 2768	2828	lanmanwrk.exe	92
PID 2828 wrote to memory of 2768	2828	lanmanwrk.exe	92
PID 2768 wrote to memory of 4108	2768	lanmanwrk.exe	94
PID 2768 wrote to memory of 4108	2768	lanmanwrk.exe	94
PID 2768 wrote to memory of 4108	2768	lanmanwrk.exe	94
PID 4108 wrote to memory of 4352	4108	lanmanwrk.exe	95
PID 4108 wrote to memory of 4352	4108	lanmanwrk.exe	95
PID 4108 wrote to memory of 4352	4108	lanmanwrk.exe	95
PID 4352 wrote to memory of 4400	4352	lanmanwrk.exe	98
PID 4352 wrote to memory of 4400	4352	lanmanwrk.exe	98
PID 4352 wrote to memory of 4400	4352	lanmanwrk.exe	98
PID 4400 wrote to memory of 4112	4400	lanmanwrk.exe	99
PID 4400 wrote to memory of 4112	4400	lanmanwrk.exe	99
PID 4400 wrote to memory of 4112	4400	lanmanwrk.exe	99
PID 4112 wrote to memory of 1752	4112	lanmanwrk.exe	100
PID 4112 wrote to memory of 1752	4112	lanmanwrk.exe	100
PID 4112 wrote to memory of 1752	4112	lanmanwrk.exe	100
PID 1752 wrote to memory of 1420	1752	lanmanwrk.exe	101
PID 1752 wrote to memory of 1420	1752	lanmanwrk.exe	101
PID 1752 wrote to memory of 1420	1752	lanmanwrk.exe	101
PID 1420 wrote to memory of 3304	1420	lanmanwrk.exe	102
PID 1420 wrote to memory of 3304	1420	lanmanwrk.exe	102
PID 1420 wrote to memory of 3304	1420	lanmanwrk.exe	102
PID 3304 wrote to memory of 536	3304	lanmanwrk.exe	103
PID 3304 wrote to memory of 536	3304	lanmanwrk.exe	103
PID 3304 wrote to memory of 536	3304	lanmanwrk.exe	103
PID 536 wrote to memory of 3852	536	lanmanwrk.exe	104
PID 536 wrote to memory of 3852	536	lanmanwrk.exe	104
PID 536 wrote to memory of 3852	536	lanmanwrk.exe	104
PID 3852 wrote to memory of 3976	3852	lanmanwrk.exe	105
PID 3852 wrote to memory of 3976	3852	lanmanwrk.exe	105
PID 3852 wrote to memory of 3976	3852	lanmanwrk.exe	105
PID 3976 wrote to memory of 4784	3976	lanmanwrk.exe	107
PID 3976 wrote to memory of 4784	3976	lanmanwrk.exe	107
PID 3976 wrote to memory of 4784	3976	lanmanwrk.exe	107

C:\Users\Admin\AppData\Local\Temp\86455e8e4776c7f0c1244a22f628742cf9569c0876b952772202228a8172c09e.exe
"C:\Users\Admin\AppData\Local\Temp\86455e8e4776c7f0c1244a22f628742cf9569c0876b952772202228a8172c09e.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\SysWOW64\lanmanwrk.exe
  "C:\Windows\System32\lanmanwrk.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\SysWOW64\lanmanwrk.exe
    "C:\Windows\System32\lanmanwrk.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:3800
  - - C:\Windows\SysWOW64\lanmanwrk.exe
      "C:\Windows\System32\lanmanwrk.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2828
    - - C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2768
      - C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4108
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4352
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4400
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1752
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1420
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3304
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:536
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3852
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3976
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4784
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        17⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        18⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        19⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        20⤵
        
        PID:1540
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        21⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        22⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        23⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        24⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        25⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        26⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        27⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        28⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        29⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        30⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        31⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        32⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        33⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        34⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        35⤵
        
        PID:2836
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        36⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        37⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        38⤵
        
        PID:1552
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        39⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        40⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        41⤵
        
        PID:1096
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        42⤵
        
        PID:2484
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        43⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        44⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        45⤵
        
        PID:3796
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        46⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        47⤵
        
        PID:4688
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        48⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        49⤵
        
        PID:3576
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        50⤵
        
        PID:4012
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        51⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        52⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        53⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        54⤵
        
        PID:3408
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        55⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        56⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        57⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        58⤵
        
        PID:548
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        59⤵
        
        PID:3620
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        60⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        61⤵
        
        PID:4392
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        62⤵
        
        PID:112
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        63⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        64⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        65⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        66⤵
        
        PID:2516
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        67⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        68⤵
        
        PID:3608
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        69⤵
        
        PID:212
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        70⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        71⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        72⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\lanmanwrk.exe
        
        "C:\Windows\System32\lanmanwrk.exe"
        73⤵
        
        PID:4948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\iexchg.dll

Filesize
106B

MD5
3989631e077483ad5a7718cb3ba14233

SHA1
cd4a100d23eda27e18e28bfd754399c2be80733c

SHA256
abffbad56ecd6cfc1afef941c11b1510d374b8be0d8a154c544a862b3518ae9d

SHA512
1eb2e5f1618ae1c141ebdd7b283c196c2ed90acb0df5a30ef163b8c966ae58a5f75f0fbf3704ddbfa8638cdbd637f6c24a0d1704aaf6b18df2928b4aa605439d

Download Submit
C:\Windows\SysWOW64\lanmanwrk.exe

Filesize
37KB

MD5
3de2f8c1feb74b2d2b2c2de4824cbaec

SHA1
adfaefe0f2e0827510320e946ab45602533e5097

SHA256
86455e8e4776c7f0c1244a22f628742cf9569c0876b952772202228a8172c09e

SHA512
48b352494db77d147a4d602f977ce07fa400d7f36c68a84b2423d88e336fc443597c0e49d53aaf72524d070f3dc4ff308265915c40594d603e2540de7c3b5038

Download Submit
memory/536-57-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/536-61-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1048-87-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1048-91-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1096-178-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1096-176-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1232-6-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1232-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1420-51-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1540-95-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1552-167-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1552-169-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1608-207-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1608-209-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1616-152-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1616-148-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1732-116-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1732-120-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1752-43-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1752-47-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1852-86-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1852-82-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1924-96-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1924-100-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1956-157-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1956-155-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2064-124-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2096-182-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2096-184-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2272-105-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2272-101-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2312-185-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2312-187-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2420-197-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2460-154-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2484-179-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2484-181-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2504-164-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2504-166-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2556-143-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2652-210-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2652-212-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2724-147-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2768-24-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2768-20-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2828-19-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2828-15-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2836-158-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2836-160-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3068-10-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3136-129-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3136-125-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3304-56-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3304-52-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3408-213-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3408-215-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3576-200-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3576-198-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3796-189-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3800-14-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3836-206-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3836-204-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3852-62-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3852-66-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3952-110-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3952-106-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3960-77-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3960-81-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3976-71-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3976-67-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4012-201-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4012-203-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4084-139-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4084-135-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4108-28-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4112-38-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4112-42-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4332-115-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4332-111-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4352-32-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4400-37-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4400-33-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4688-193-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4688-195-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4744-175-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4744-173-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4784-72-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4784-76-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4804-163-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4804-161-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4904-170-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4904-172-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4976-130-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4976-134-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/5088-192-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/5088-190-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download