Analysis
- max time kernel
149s - max time network
104s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
31/10/2025, 22:31
General
- Target file.exe
- Size 5.8MB
- Sample251031-2frv3abs7f
- SHA256 b9c49d3339245f2df18613613625c6ec445c0fdfd7d565129ea25713389f5592
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5296-17-0x0000000140000000-0x000000014009C000-memory.dmp
memory/5296-1-0x000001B26F5F0000-0x000001B26F9F0000-memory.dmp
memory/5296-2-0x000001B26F5F0000-0x000001B26F9F0000-memory.dmp
memory/5296-3-0x000001B26F5F0000-0x000001B26F9F0000-memory.dmp
memory/5296-4-0x00007FFAE6A40000-0x00007FFAE6C49000-memory.dmp
memory/5296-5-0x000001B26F5F0000-0x000001B26F9F0000-memory.dmp
memory/5296-6-0x00007FFAE5170000-0x00007FFAE522D000-memory.dmp
memory/5296-7-0x00007FFAE4470000-0x00007FFAE47E4000-memory.dmp
memory/5296-0-0x0000000140000000-0x000000014009C000-memory.dmp
memory/5296-18-0x000001B26F5F0000-0x000001B26F9F0000-memory.dmp
memory/5496-8-0x0000025B83B40000-0x0000025B83B4A000-memory.dmp
memory/5496-15-0x00007FFAE4470000-0x00007FFAE47E4000-memory.dmp
memory/5496-14-0x00007FFAE5170000-0x00007FFAE522D000-memory.dmp
memory/5496-13-0x00007FFAE6A40000-0x00007FFAE6C49000-memory.dmp
memory/5496-12-0x0000025B85640000-0x0000025B85A40000-memory.dmp
memory/5496-16-0x0000025B85640000-0x0000025B85A40000-memory.dmp
memory/5496-10-0x0000025B85640000-0x0000025B85A40000-memory.dmp
memory/5496-11-0x0000025B85640000-0x0000025B85A40000-memory.dmp