5c3bde59fa48471670841beba658fc9cfe707fac64b4b7f8446dd51a7706d133 | Triage

Analysis

max time kernel
146s
max time network
148s
platform
windows10_x64
resource
win10v200430
submitted
19-07-2020 19:29

Sharing

Report Analysis Logs

General

Target

uncategorized_2.2.0.0.vir.exe
Size

281KB
MD5

d1a9338fc86ea88c1e8408d736ba13ec
SHA1

01e9ec2d7a136aff0a98842fa876588c564809a7
SHA256

5c3bde59fa48471670841beba658fc9cfe707fac64b4b7f8446dd51a7706d133
SHA512

18b5177c0ffeac359a9f19d670b28eab66ef6bcd0184c005fbfedd2b060f6972ae8da4a06261bf479db06a9e1c7f017388cbaf9a934c090a652eaf107a0ccf27

Score

5^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

uncategorized_2.2.0.0.vir.exe

pid process

3848 uncategorized_2.2.0.0.vir.exe
3848 uncategorized_2.2.0.0.vir.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

uncategorized_2.2.0.0.vir.exe

description	pid	process	target process
PID 3848 wrote to memory of 1232	3848	uncategorized_2.2.0.0.vir.exe	uncategorized_2.2.0.0.vir.exe
PID 3848 wrote to memory of 1232	3848	uncategorized_2.2.0.0.vir.exe	uncategorized_2.2.0.0.vir.exe
PID 3848 wrote to memory of 1232	3848	uncategorized_2.2.0.0.vir.exe	uncategorized_2.2.0.0.vir.exe
PID 3848 wrote to memory of 1232	3848	uncategorized_2.2.0.0.vir.exe	uncategorized_2.2.0.0.vir.exe
PID 3848 wrote to memory of 1232	3848	uncategorized_2.2.0.0.vir.exe	uncategorized_2.2.0.0.vir.exe
PID 3848 wrote to memory of 1232	3848	uncategorized_2.2.0.0.vir.exe	uncategorized_2.2.0.0.vir.exe
PID 3848 wrote to memory of 1232	3848	uncategorized_2.2.0.0.vir.exe	uncategorized_2.2.0.0.vir.exe
PID 3848 wrote to memory of 1232	3848	uncategorized_2.2.0.0.vir.exe	uncategorized_2.2.0.0.vir.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

uncategorized_2.2.0.0.vir.exe

description pid process target process

PID 3848 set thread context of 1232 3848 uncategorized_2.2.0.0.vir.exe uncategorized_2.2.0.0.vir.exe

C:\Users\Admin\AppData\Local\Temp\uncategorized_2.2.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\uncategorized_2.2.0.0.vir.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:3848

C:\Users\Admin\AppData\Local\Temp\uncategorized_2.2.0.0.vir.exe
C:\Users\Admin\AppData\Local\Temp\uncategorized_2.2.0.0.vir.exe
2⤵
PID:1232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1232-0-0x0000000000400000-0x0000000006800000-memory.dmp

Filesize
100.0MB

Download
memory/1232-1-0x000000000041733B-mapping.dmp

Download
memory/1232-2-0x0000000000400000-0x0000000006800000-memory.dmp

Filesize
100.0MB

Download