Analysis
- max time kernel
106s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20250610-en - resource tags
- submitted
09/10/2025, 04:01
General
- Target file.exe
- Size 832KB
- Sample251009-elca8syvb1
- SHA256 7f2b86e0352b6ceddfdbc7d74cd277cc1b084a673a6c9e6a1a4e0e341d6f0e36
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3572-1-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-39-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-31-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-0-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-3-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-115-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-125-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-123-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-121-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-119-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-117-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-113-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-111-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-109-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-107-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-105-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-103-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-101-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-99-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-97-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-95-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-93-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-91-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-87-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-86-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-83-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-79-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-77-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-75-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-73-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-71-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-69-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-65-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-63-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-61-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-59-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-57-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-55-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-89-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-81-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-67-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-53-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-51-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-49-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-47-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-45-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-43-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-41-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-37-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-36-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-33-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-29-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-27-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-25-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-23-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-21-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-20-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-18-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-16-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-13-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-11-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-9-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-7-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-5-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/3572-291-0x0000022AE04B0000-0x0000022AE08B0000-memory.dmp
memory/3572-292-0x0000022AE04B0000-0x0000022AE08B0000-memory.dmp
memory/5936-300-0x000001F561A20000-0x000001F561E20000-memory.dmp
memory/5936-303-0x000001F561A20000-0x000001F561E20000-memory.dmp
memory/5936-305-0x000001F561A20000-0x000001F561E20000-memory.dmp