19d32c1fc7c6fa9a5924aeb6ce69d8e5211c3e458eb51178171e0c75f129c48a | Triage

Analysis

max time kernel
135s
max time network
51s
platform
windows10_x64
resource
win10v200430
submitted
19-07-2020 19:44

Sharing

Report Analysis Logs

General

Target

uncategorized_9.0.0.2.vir.exe
Size

224KB
MD5

3706da30e1fc51212ae95aff2fae57ad
SHA1

72029dca348d3fa4faa43d9999fa1b744bb559cd
SHA256

19d32c1fc7c6fa9a5924aeb6ce69d8e5211c3e458eb51178171e0c75f129c48a
SHA512

0d8ae837a6e0a0f9ad582fb94b5a997d30066194f8428e77bdfa2cbe2669dbaa3784752ea41e354c9806bde1792392d930c0d365522f4f0cc762595e00b16897

Score

5^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

uncategorized_9.0.0.2.vir.exe

description	pid	process	target process
PID 2804 wrote to memory of 1500	2804	uncategorized_9.0.0.2.vir.exe	uncategorized_9.0.0.2.vir.exe
PID 2804 wrote to memory of 1500	2804	uncategorized_9.0.0.2.vir.exe	uncategorized_9.0.0.2.vir.exe
PID 2804 wrote to memory of 1500	2804	uncategorized_9.0.0.2.vir.exe	uncategorized_9.0.0.2.vir.exe
PID 2804 wrote to memory of 1500	2804	uncategorized_9.0.0.2.vir.exe	uncategorized_9.0.0.2.vir.exe
PID 2804 wrote to memory of 1500	2804	uncategorized_9.0.0.2.vir.exe	uncategorized_9.0.0.2.vir.exe
PID 2804 wrote to memory of 1500	2804	uncategorized_9.0.0.2.vir.exe	uncategorized_9.0.0.2.vir.exe
PID 2804 wrote to memory of 1500	2804	uncategorized_9.0.0.2.vir.exe	uncategorized_9.0.0.2.vir.exe
PID 2804 wrote to memory of 1500	2804	uncategorized_9.0.0.2.vir.exe	uncategorized_9.0.0.2.vir.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

uncategorized_9.0.0.2.vir.exe

description pid process target process

PID 2804 set thread context of 1500 2804 uncategorized_9.0.0.2.vir.exe uncategorized_9.0.0.2.vir.exe

C:\Users\Admin\AppData\Local\Temp\uncategorized_9.0.0.2.vir.exe
"C:\Users\Admin\AppData\Local\Temp\uncategorized_9.0.0.2.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:2804

C:\Users\Admin\AppData\Local\Temp\uncategorized_9.0.0.2.vir.exe
C:\Users\Admin\AppData\Local\Temp\uncategorized_9.0.0.2.vir.exe
2⤵
PID:1500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1500-1-0x0000000000410440-mapping.dmp

Download
memory/1500-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1500-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download