b4afc259d1032bf4ac6db0092d7b364fb11458a4c2100aa2606df6d81e5d5122 | Triage™

Analysis

max time kernel
146s
max time network
145s
platform
windows7_x64
resource
win7v20201028
submitted
09/11/2020, 20:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Generic.mg.7edda525c176c63c.14920.exe
Size 124KB
Sample201109-h2byshlf4e
SHA256 b4afc259d1032bf4ac6db0092d7b364fb11458a4c2100aa2606df6d81e5d5122
MD5 7edda525c176c63cac5444b6bc0f3921
SHA1 8503031bd2e0cbf9db1dde2cb8f4dba699cb8914
SHA512 b01024ed67570533ed758c6ec3298b1ea668c087372bf2190c846bc566b4f08db4cf3172a335278482e9ec1945b93a8318c4aa461f5ac2fc46c4bd636e5e63ea
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1744 set thread context of 1812	1744	SecuriteInfo.com.Generic.mg.7edda525c176c63c.14920.exe	28

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 1812	1744	SecuriteInfo.com.Generic.mg.7edda525c176c63c.14920.exe	28
PID 1744 wrote to memory of 1812	1744	SecuriteInfo.com.Generic.mg.7edda525c176c63c.14920.exe	28
PID 1744 wrote to memory of 1812	1744	SecuriteInfo.com.Generic.mg.7edda525c176c63c.14920.exe	28
PID 1744 wrote to memory of 1812	1744	SecuriteInfo.com.Generic.mg.7edda525c176c63c.14920.exe	28
PID 1744 wrote to memory of 1812	1744	SecuriteInfo.com.Generic.mg.7edda525c176c63c.14920.exe	28

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.7edda525c176c63c.14920.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.7edda525c176c63c.14920.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\winver.exe
  winver.exe
  2⤵
  PID:1812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-2-0x000007FEF63D0000-0x000007FEF664A000-memory.dmp

Download

memory/1812-0-0x0000000000080000-0x0000000000088000-memory.dmp

Download