Analysis
- max time kernel
100s - max time network
104s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
- submitted
09/10/2025, 04:01
General
- Target file.exe
- Size 832KB
- Sample251009-elca8syvb1
- SHA256 7f2b86e0352b6ceddfdbc7d74cd277cc1b084a673a6c9e6a1a4e0e341d6f0e36
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2108-303-0x000001DDECC00000-0x000001DDED000000-memory.dmp
memory/2108-300-0x000001DDECC00000-0x000001DDED000000-memory.dmp
memory/2108-305-0x000001DDECC00000-0x000001DDED000000-memory.dmp
memory/4660-1-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-9-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-99-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-101-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-111-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-123-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-119-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-117-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-115-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-113-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-109-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-107-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-105-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-103-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-125-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-121-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-97-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-95-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-93-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-91-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-89-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-87-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-85-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-83-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-79-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-77-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-75-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-73-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-71-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-69-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-67-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-65-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-63-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-81-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-61-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-59-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-55-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-53-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-292-0x0000026081E90000-0x0000026082290000-memory.dmp
memory/4660-291-0x0000026081E90000-0x0000026082290000-memory.dmp
memory/4660-49-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-47-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-43-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-41-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-39-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-38-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-33-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-31-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-29-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-27-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-23-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-21-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-19-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-17-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-15-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-11-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-7-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-5-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-3-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-57-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-51-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-45-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-35-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-25-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-13-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4660-0-0x0000000140000000-0x00000001400A6000-memory.dmp