Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-11-2024 14:19

General

  • Target

    $APPDATA/RuntimeBroker.exe

  • Size

    58KB

  • MD5

    411e7ed61ef7002096f3e3d2ce519734

  • SHA1

    fdf8d29b4b310974477539fc35c3b3d327963c6c

  • SHA256

    822c45c64e7c5e5781cc07933042ed274b13083ab32125efcd8d68cb33a899bc

  • SHA512

    7500c26d1a3e6c3e318c48799c4adb35dfb8940daef7950a451fe78c6433cec057d4fdf4cc024e6e172568253056b869dec058f9b2d3c21e0a8c25001887bfe2

  • SSDEEP

    768:nyVi4c//HcAtm3sMMX+KYlZT7IVHrzvR+g2ikZTn2vwE+WPkeicvKmfg7UbcKjb/:nDb8QD+KYlZToV+Yk/cimfu6cK37L

Score
6/10

Malware Config

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\$APPDATA\RuntimeBroker.exe
    "C:\Users\Admin\AppData\Local\Temp\$APPDATA\RuntimeBroker.exe"
    1⤵
    • Adds Run key to start application
    PID:4952

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4952-0-0x00007FF9184C3000-0x00007FF9184C5000-memory.dmp

    Filesize

    8KB

  • memory/4952-1-0x00000000007E0000-0x00000000007F4000-memory.dmp

    Filesize

    80KB

  • memory/4952-2-0x000000001AFA0000-0x000000001AFA6000-memory.dmp

    Filesize

    24KB

  • memory/4952-3-0x00007FF9184C3000-0x00007FF9184C5000-memory.dmp

    Filesize

    8KB