936db64a9044bbaefe18d5e03281ebe45064539d4511e57cfea0ae64aa087377 | Triage

Analysis

max time kernel
13s
max time network
15s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 16:11

Sharing

Report Analysis Logs

General

Target

AnyDesk.exe
Size

10.0MB
MD5

5bd41fb32a3431b5a9f368aea302a6da
SHA1

79a6a63185607a5ac18cb62e9bb750ca73f6576d
SHA256

936db64a9044bbaefe18d5e03281ebe45064539d4511e57cfea0ae64aa087377
SHA512

807dab802e87fd0c63c7f68552ffb23d2c2eb279648dfc6393d79cda5e515be0f5a3313ae8c53f14c1fff3fe9068f7749488aa33fd149f51b135684eb07d1ae7
SSDEEP

196608:sZC1F51m8yWTFJK/bnhTV2Dv2nQlq8ZbeiVXreEO74LQQ6n:bFjhK/bnhTVC7nSUKEAeQQk

Score

5^/10

Malware Config

Signatures

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4620	AnyDesk.exe

C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"
1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:4620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4620-0-0x0000000140000000-0x0000000140F29000-memory.dmp

Filesize
15.2MB

Download
memory/4620-1-0x0000000140000000-0x0000000140F29000-memory.dmp

Filesize
15.2MB

Download