51bc210eb085de493839d64fb12c5dddfeb856a8f590587222e42dd6f6118bc1

Analysis

max time kernel
5s
max time network
9s
platform
windows7_x64
resource
win7v20201028
submitted
09-11-2020 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51bc210eb085de493839d64fb12c5dddfeb856a8f590587222e42dd6f6118bc1.exe
Size

237KB
MD5

5786626c02a1aeb010306d47b707ae69
SHA1

0f74a367aabb0b88b821243727399599958f5883
SHA256

51bc210eb085de493839d64fb12c5dddfeb856a8f590587222e42dd6f6118bc1
SHA512

e981e8f535648d9ddba590fa9214e7e030dd87eaed8e086cdb8f9e48344932b2f64437ddc05c2b44f4c1cf9bfaa2e4c2f982f7660d64486aaf000a0f8ffa9d1d

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

51bc210eb085de493839d64fb12c5dddfeb856a8f590587222e42dd6f6118bc1.exe

description	pid	process	target process
PID 844 set thread context of 2044	844	51bc210eb085de493839d64fb12c5dddfeb856a8f590587222e42dd6f6118bc1.exe	51bc210eb085de493839d64fb12c5dddfeb856a8f590587222e42dd6f6118bc1.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

51bc210eb085de493839d64fb12c5dddfeb856a8f590587222e42dd6f6118bc1.exe

description	pid	process	target process
PID 844 wrote to memory of 2044	844	51bc210eb085de493839d64fb12c5dddfeb856a8f590587222e42dd6f6118bc1.exe	51bc210eb085de493839d64fb12c5dddfeb856a8f590587222e42dd6f6118bc1.exe
PID 844 wrote to memory of 2044	844	51bc210eb085de493839d64fb12c5dddfeb856a8f590587222e42dd6f6118bc1.exe	51bc210eb085de493839d64fb12c5dddfeb856a8f590587222e42dd6f6118bc1.exe
PID 844 wrote to memory of 2044	844	51bc210eb085de493839d64fb12c5dddfeb856a8f590587222e42dd6f6118bc1.exe	51bc210eb085de493839d64fb12c5dddfeb856a8f590587222e42dd6f6118bc1.exe
PID 844 wrote to memory of 2044	844	51bc210eb085de493839d64fb12c5dddfeb856a8f590587222e42dd6f6118bc1.exe	51bc210eb085de493839d64fb12c5dddfeb856a8f590587222e42dd6f6118bc1.exe
PID 844 wrote to memory of 2044	844	51bc210eb085de493839d64fb12c5dddfeb856a8f590587222e42dd6f6118bc1.exe	51bc210eb085de493839d64fb12c5dddfeb856a8f590587222e42dd6f6118bc1.exe
PID 844 wrote to memory of 2044	844	51bc210eb085de493839d64fb12c5dddfeb856a8f590587222e42dd6f6118bc1.exe	51bc210eb085de493839d64fb12c5dddfeb856a8f590587222e42dd6f6118bc1.exe
PID 844 wrote to memory of 2044	844	51bc210eb085de493839d64fb12c5dddfeb856a8f590587222e42dd6f6118bc1.exe	51bc210eb085de493839d64fb12c5dddfeb856a8f590587222e42dd6f6118bc1.exe
PID 844 wrote to memory of 2044	844	51bc210eb085de493839d64fb12c5dddfeb856a8f590587222e42dd6f6118bc1.exe	51bc210eb085de493839d64fb12c5dddfeb856a8f590587222e42dd6f6118bc1.exe
PID 844 wrote to memory of 2044	844	51bc210eb085de493839d64fb12c5dddfeb856a8f590587222e42dd6f6118bc1.exe	51bc210eb085de493839d64fb12c5dddfeb856a8f590587222e42dd6f6118bc1.exe

C:\Users\Admin\AppData\Local\Temp\51bc210eb085de493839d64fb12c5dddfeb856a8f590587222e42dd6f6118bc1.exe
"C:\Users\Admin\AppData\Local\Temp\51bc210eb085de493839d64fb12c5dddfeb856a8f590587222e42dd6f6118bc1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:844

C:\Users\Admin\AppData\Local\Temp\51bc210eb085de493839d64fb12c5dddfeb856a8f590587222e42dd6f6118bc1.exe
"C:\Users\Admin\AppData\Local\Temp\51bc210eb085de493839d64fb12c5dddfeb856a8f590587222e42dd6f6118bc1.exe"
2⤵
PID:2044

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2044-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2044-1-0x0000000000434055-mapping.dmp

Download
memory/2044-2-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download