Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/07/2026, 00:31
General
- Target file.exe
- Size 686KB
- Sample260704-at32pshy21
- SHA256 ffc708aed38519ea8799e0cabebf6444934d1aa7db9f83a3c31b6847ed139b6d
Malware Config
Signatures
- Adds policy Run key to start application 2 TTPs 2 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Adds policy Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\RuntimeBroker.exe"C:\Windows\System32\RuntimeBroker.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\setup_3eeb3036\setup_3eeb3036.exe"C:\Users\Admin\AppData\Local\Temp\setup_3eeb3036\setup_3eeb3036.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\RuntimeBroker.exe"C:\Windows\System32\RuntimeBroker.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
TmpA8DD.tmp
setup_3eeb3036.exe
memory/544-895-0x0000027D54F90000-0x0000027D54FB4000-memory.dmp
memory/544-898-0x0000027D54F90000-0x0000027D54FB4000-memory.dmp
memory/544-896-0x0000027D54F90000-0x0000027D54FB4000-memory.dmp
memory/544-894-0x0000027D54F90000-0x0000027D54FB4000-memory.dmp
memory/544-897-0x0000027D54F90000-0x0000027D54FB4000-memory.dmp
memory/1912-0-0x000001D8453A0000-0x000001D84548D000-memory.dmp
memory/1912-438-0x000001D843AF0000-0x000001D843AFB000-memory.dmp
memory/3272-902-0x00000213CE070000-0x00000213CE0BC000-memory.dmp
memory/3272-901-0x00000213B5650000-0x00000213B5668000-memory.dmp
memory/3272-890-0x00000213B3CB0000-0x00000213B3CBB000-memory.dmp
memory/3272-900-0x00000213B57C0000-0x00000213B5814000-memory.dmp
memory/4252-449-0x0000028B96750000-0x0000028B96774000-memory.dmp
memory/4252-446-0x0000028B96750000-0x0000028B96774000-memory.dmp
memory/4252-447-0x0000028B96750000-0x0000028B96774000-memory.dmp
memory/4252-448-0x0000028B96750000-0x0000028B96774000-memory.dmp
memory/4252-450-0x0000028B96750000-0x0000028B96774000-memory.dmp
memory/4252-441-0x0000028B96610000-0x0000028B9662E000-memory.dmp