6696105b5c08ad9a5c5ffcd5a397612d4908a034ad4faa1e8f1df9352ad41cc5

General

Target

8ad6032daa80a5adaa61010895ed78ce.exe
Size

431KB
MD5

8ad6032daa80a5adaa61010895ed78ce
SHA1

95e3899672ba3f7352806a6b663959c888911069
SHA256

6696105b5c08ad9a5c5ffcd5a397612d4908a034ad4faa1e8f1df9352ad41cc5
SHA512

61c9723ef7458a8da34913a9e80a440d9094c52dde2ac13bc29c6f7c4c7a92903449917c1d64ae07b56102817f2a80e6d754e2195a701748d9f8a12f85043469

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

8ad6032daa80a5adaa61010895ed78ce.exe

description pid process target process

PID 788 set thread context of 1996 788 8ad6032daa80a5adaa61010895ed78ce.exe MSBuild.exe

description	pid	process	target process
PID 788 set thread context of 1996	788	8ad6032daa80a5adaa61010895ed78ce.exe	MSBuild.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

8ad6032daa80a5adaa61010895ed78ce.exe

description	pid	process	target process
PID 788 wrote to memory of 1996	788	8ad6032daa80a5adaa61010895ed78ce.exe	MSBuild.exe
PID 788 wrote to memory of 1996	788	8ad6032daa80a5adaa61010895ed78ce.exe	MSBuild.exe
PID 788 wrote to memory of 1996	788	8ad6032daa80a5adaa61010895ed78ce.exe	MSBuild.exe
PID 788 wrote to memory of 1996	788	8ad6032daa80a5adaa61010895ed78ce.exe	MSBuild.exe
PID 788 wrote to memory of 1996	788	8ad6032daa80a5adaa61010895ed78ce.exe	MSBuild.exe
PID 788 wrote to memory of 1996	788	8ad6032daa80a5adaa61010895ed78ce.exe	MSBuild.exe
PID 788 wrote to memory of 1996	788	8ad6032daa80a5adaa61010895ed78ce.exe	MSBuild.exe
PID 788 wrote to memory of 1996	788	8ad6032daa80a5adaa61010895ed78ce.exe	MSBuild.exe
PID 788 wrote to memory of 1996	788	8ad6032daa80a5adaa61010895ed78ce.exe	MSBuild.exe
PID 788 wrote to memory of 1996	788	8ad6032daa80a5adaa61010895ed78ce.exe	MSBuild.exe
PID 788 wrote to memory of 1996	788	8ad6032daa80a5adaa61010895ed78ce.exe	MSBuild.exe
PID 788 wrote to memory of 1996	788	8ad6032daa80a5adaa61010895ed78ce.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\8ad6032daa80a5adaa61010895ed78ce.exe
"C:\Users\Admin\AppData\Local\Temp\8ad6032daa80a5adaa61010895ed78ce.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:788

C:\Windows\Microsoft.Net\Framework64\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.Net\Framework64\v4.0.30319\MSBuild.exe
2⤵
PID:1996

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/788-60-0x000000013F940000-0x000000013F941000-memory.dmp

Filesize
4KB

Download
memory/788-76-0x000000001BA20000-0x000000001BA22000-memory.dmp

Filesize
8KB

Download
memory/1996-73-0x000000001AE30000-0x000000001AE31000-memory.dmp

Filesize
4KB

Download
memory/1996-72-0x000000001AE00000-0x000000001AE01000-memory.dmp

Filesize
4KB

Download
memory/1996-66-0x000000001BBE0000-0x000000001BBE1000-memory.dmp

Filesize
4KB

Download
memory/1996-67-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1996-68-0x0000000002290000-0x000000000232C000-memory.dmp

Filesize
624KB

Download
memory/1996-69-0x000000001B9B0000-0x000000001B9B1000-memory.dmp

Filesize
4KB

Download
memory/1996-70-0x000000001ADC0000-0x000000001ADC1000-memory.dmp

Filesize
4KB

Download
memory/1996-71-0x000000001BA80000-0x000000001BA81000-memory.dmp

Filesize
4KB

Download
memory/1996-63-0x0000000140008630-mapping.dmp

Download
memory/1996-64-0x0000000000750000-0x000000000076F000-memory.dmp

Filesize
124KB

Download
memory/1996-74-0x000000001B280000-0x000000001B281000-memory.dmp

Filesize
4KB

Download
memory/1996-75-0x0000000000780000-0x0000000000781000-memory.dmp

Filesize
4KB

Download
memory/1996-79-0x000000001BB64000-0x000000001BB66000-memory.dmp

Filesize
8KB

Download
memory/1996-80-0x000000001BB66000-0x000000001BB67000-memory.dmp

Filesize
4KB

Download
memory/1996-78-0x000000001BB62000-0x000000001BB64000-memory.dmp

Filesize
8KB

Download
memory/1996-77-0x0000000140000000-0x0000000140047000-memory.dmp

Filesize
284KB

Download
memory/1996-62-0x0000000140000000-0x0000000140047000-memory.dmp

Filesize
284KB

Download
memory/1996-81-0x000000001BB67000-0x000000001BB68000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads