Automated Malware Analysis IOC Report for

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\5390d36a371f0598b86301961d5fdb329e368e7a.exe

"C:\Users\user\Desktop\5390d36a371f0598b86301961d5fdb329e368e7a.exe"

Details

Is windows:	true
Is dropped:	false
PID:	7564
Target ID:	0
Parent PID:	2580
Name:	5390d36a371f0598b86301961d5fdb329e368e7a.exe
Path:	C:\Users\user\Desktop\5390d36a371f0598b86301961d5fdb329e368e7a.exe
Commandline:	"C:\Users\user\Desktop\5390d36a371f0598b86301961d5fdb329e368e7a.exe"
Size:	10525696
MD5:	0447E67DA4FB72BDDE31BD7EC2B62E04
Time:	10:57:44
Date:	27/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x140000000
Modulesize:	10539008
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
PE file contains executable resources (Code or Archives)	System Summary
Sample file is different than original file name gathered from version info	System Summary
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
PE file has an executable .text section and no other executable section	System Summary
URLs found in memory or binary data	Networking
PE file contains a valid data directory to section mapping	System Summary
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
PE file has a big raw section	System Summary
PE file has a high image base, often used for DLLs	System Summary
Submission file is bigger than most known malware samples	System Summary

URLs

Name

Malicious

http://www.winimage.com/zLibDll

unknown

Details

Name:	http://www.winimage.com/zLibDll
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\5390d36a371f0598b86301961d5fdb329e368e7a.exe
Source:	5390d36a371f0598b86301961d5fdb329e368e7a.exe

Signature Hits	Behavior Group	Mitre Attack
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
URLs found in memory or binary data	Networking

Memdumps

Base Address

Regiontype

Protect

Malicious

140038000

unkown

page readonly

140026000

unkown

page readonly

140000000

unkown

page readonly

140001000

unkown

page execute read

140036000

unkown

page write copy

140036000

unkown

page write copy

140038000

unkown

page readonly

140026000

unkown

page readonly

140000000

unkown

page readonly

140001000

unkown

page execute read

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
5390d36a371f0598b86301961d5fdb329e368e7a

Processes

URLs

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report5390d36a371f0598b86301961d5fdb329e368e7a

Processes

URLs

Memdumps

IOC Report
5390d36a371f0598b86301961d5fdb329e368e7a