Analysis
- max time kernel
148s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/07/2026, 12:27
General
- Target a.exe
- Size 111KB
- Sample260730-pm7tmshe39
- SHA256 02a04456bb5725fffb1afc5a47231a6362f04802a076c6230ed2bcde95c583d4
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a.exe"C:\Users\Admin\AppData\Local\Temp\a.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "3360" "2360" "2248" "2344" "0" "0" "2364" "0" "0" "0" "0" "0"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3360-0-0x00007FFDAF6AF000-0x00007FFDAF6B0000-memory.dmp
memory/3360-4-0x000002247F730000-0x000002247F752000-memory.dmp
memory/3360-1-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp
memory/3360-5-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp
memory/3360-6-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp
memory/3360-7-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp
memory/3360-8-0x000002247FC10000-0x000002247FC58000-memory.dmp
memory/3360-9-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp
memory/3360-10-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp
memory/3360-11-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp
memory/3360-12-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp
memory/3360-13-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp
memory/3360-18-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp
memory/3360-17-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp