2a7bc92ba6c0b1e2aa9439fdc63d4c9b03928a83444155828538cd8e78362ad5 | Triage

Analysis

max time kernel
140s
max time network
141s
platform
windows10_x64
resource
win10
submitted
19-07-2020 17:27

Sharing

Report Analysis Logs

General

Target

uncategorized_4.5.4.5.vir.exe
Size

224KB
MD5

915cc8c31e37f88a6be43ae64602acd4
SHA1

d043149e6050497ab7ae81d29419c586e5e9cf64
SHA256

2a7bc92ba6c0b1e2aa9439fdc63d4c9b03928a83444155828538cd8e78362ad5
SHA512

0ce24074a6d06bc3f6419490319a90814bf06bbb0faa98e4ba49ffe6b8c91cf2352fd0aac19f79dd0bbbcf39fc22f028a0df906f3365c953f03ddb4956969a2a

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

uncategorized_4.5.4.5.vir.exe

description pid process target process

PID 2460 set thread context of 3876 2460 uncategorized_4.5.4.5.vir.exe uncategorized_4.5.4.5.vir.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

uncategorized_4.5.4.5.vir.exe

pid process

2460 uncategorized_4.5.4.5.vir.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

uncategorized_4.5.4.5.vir.exe

description	pid	process	target process
PID 2460 wrote to memory of 3876	2460	uncategorized_4.5.4.5.vir.exe	uncategorized_4.5.4.5.vir.exe
PID 2460 wrote to memory of 3876	2460	uncategorized_4.5.4.5.vir.exe	uncategorized_4.5.4.5.vir.exe
PID 2460 wrote to memory of 3876	2460	uncategorized_4.5.4.5.vir.exe	uncategorized_4.5.4.5.vir.exe
PID 2460 wrote to memory of 3876	2460	uncategorized_4.5.4.5.vir.exe	uncategorized_4.5.4.5.vir.exe
PID 2460 wrote to memory of 3876	2460	uncategorized_4.5.4.5.vir.exe	uncategorized_4.5.4.5.vir.exe
PID 2460 wrote to memory of 3876	2460	uncategorized_4.5.4.5.vir.exe	uncategorized_4.5.4.5.vir.exe
PID 2460 wrote to memory of 3876	2460	uncategorized_4.5.4.5.vir.exe	uncategorized_4.5.4.5.vir.exe
PID 2460 wrote to memory of 3876	2460	uncategorized_4.5.4.5.vir.exe	uncategorized_4.5.4.5.vir.exe

C:\Users\Admin\AppData\Local\Temp\uncategorized_4.5.4.5.vir.exe
"C:\Users\Admin\AppData\Local\Temp\uncategorized_4.5.4.5.vir.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460

C:\Users\Admin\AppData\Local\Temp\uncategorized_4.5.4.5.vir.exe
"C:\Users\Admin\AppData\Local\Temp\uncategorized_4.5.4.5.vir.exe"
2⤵
PID:3876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3876-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3876-3-0x0000000000418ADF-mapping.dmp

Download
memory/3876-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download