Analysis
-
max time kernel
3s -
max time network
55s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
26-07-2021 23:02
Static task
static1
Behavioral task
behavioral1
Sample
8ad6032daa80a5adaa61010895ed78ce.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
8ad6032daa80a5adaa61010895ed78ce.exe
-
Size
431KB
-
MD5
8ad6032daa80a5adaa61010895ed78ce
-
SHA1
95e3899672ba3f7352806a6b663959c888911069
-
SHA256
6696105b5c08ad9a5c5ffcd5a397612d4908a034ad4faa1e8f1df9352ad41cc5
-
SHA512
61c9723ef7458a8da34913a9e80a440d9094c52dde2ac13bc29c6f7c4c7a92903449917c1d64ae07b56102817f2a80e6d754e2195a701748d9f8a12f85043469
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
8ad6032daa80a5adaa61010895ed78ce.exedescription pid process target process PID 288 set thread context of 1980 288 8ad6032daa80a5adaa61010895ed78ce.exe MSBuild.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
8ad6032daa80a5adaa61010895ed78ce.exedescription pid process target process PID 288 wrote to memory of 1980 288 8ad6032daa80a5adaa61010895ed78ce.exe MSBuild.exe PID 288 wrote to memory of 1980 288 8ad6032daa80a5adaa61010895ed78ce.exe MSBuild.exe PID 288 wrote to memory of 1980 288 8ad6032daa80a5adaa61010895ed78ce.exe MSBuild.exe PID 288 wrote to memory of 1980 288 8ad6032daa80a5adaa61010895ed78ce.exe MSBuild.exe PID 288 wrote to memory of 1980 288 8ad6032daa80a5adaa61010895ed78ce.exe MSBuild.exe PID 288 wrote to memory of 1980 288 8ad6032daa80a5adaa61010895ed78ce.exe MSBuild.exe PID 288 wrote to memory of 1980 288 8ad6032daa80a5adaa61010895ed78ce.exe MSBuild.exe PID 288 wrote to memory of 1980 288 8ad6032daa80a5adaa61010895ed78ce.exe MSBuild.exe PID 288 wrote to memory of 1980 288 8ad6032daa80a5adaa61010895ed78ce.exe MSBuild.exe PID 288 wrote to memory of 1980 288 8ad6032daa80a5adaa61010895ed78ce.exe MSBuild.exe PID 288 wrote to memory of 1980 288 8ad6032daa80a5adaa61010895ed78ce.exe MSBuild.exe PID 288 wrote to memory of 1980 288 8ad6032daa80a5adaa61010895ed78ce.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ad6032daa80a5adaa61010895ed78ce.exe"C:\Users\Admin\AppData\Local\Temp\8ad6032daa80a5adaa61010895ed78ce.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.Net\Framework64\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.Net\Framework64\v4.0.30319\MSBuild.exe2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/288-59-0x000000013FF60000-0x000000013FF61000-memory.dmpFilesize
4KB
-
memory/288-75-0x000000001B2F0000-0x000000001B2F2000-memory.dmpFilesize
8KB
-
memory/1980-71-0x0000000002080000-0x0000000002081000-memory.dmpFilesize
4KB
-
memory/1980-72-0x00000000020B0000-0x00000000020B1000-memory.dmpFilesize
4KB
-
memory/1980-65-0x000000001BAD0000-0x000000001BAD1000-memory.dmpFilesize
4KB
-
memory/1980-66-0x0000000001EA0000-0x0000000001EA1000-memory.dmpFilesize
4KB
-
memory/1980-67-0x0000000002170000-0x000000000220C000-memory.dmpFilesize
624KB
-
memory/1980-68-0x000000001B530000-0x000000001B531000-memory.dmpFilesize
4KB
-
memory/1980-69-0x0000000002040000-0x0000000002041000-memory.dmpFilesize
4KB
-
memory/1980-70-0x000000001C480000-0x000000001C481000-memory.dmpFilesize
4KB
-
memory/1980-62-0x0000000140008630-mapping.dmp
-
memory/1980-63-0x0000000001E80000-0x0000000001E9F000-memory.dmpFilesize
124KB
-
memory/1980-73-0x00000000022A0000-0x00000000022A1000-memory.dmpFilesize
4KB
-
memory/1980-74-0x00000000020E0000-0x00000000020E1000-memory.dmpFilesize
4KB
-
memory/1980-61-0x0000000140000000-0x0000000140047000-memory.dmpFilesize
284KB
-
memory/1980-76-0x0000000140000000-0x0000000140047000-memory.dmpFilesize
284KB
-
memory/1980-78-0x000000001B604000-0x000000001B606000-memory.dmpFilesize
8KB
-
memory/1980-77-0x000000001B602000-0x000000001B604000-memory.dmpFilesize
8KB
-
memory/1980-79-0x000000001B606000-0x000000001B607000-memory.dmpFilesize
4KB
-
memory/1980-80-0x000000001B607000-0x000000001B608000-memory.dmpFilesize
4KB