9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e

Target

9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e.exe
Size

360KB
MD5

6e223f8e362245614a74d9865d0817b0
SHA1

dd8d9ea9d62bcf6a7e69bbf6dd81457103bcc29e
SHA256

9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e
SHA512

36321cbe8c9b17a939241247baa27e204f51c2f8c8667cafd3ddd939159412ead8addf663b2285499396917f1bebe51cc9f1ec7c218645f877860010da5c4e1a

Score

8^/10

Malware Config

Executes dropped EXE 1 IoCs

pid	Process
3008	9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 744 set thread context of 3008	744	9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e.exe	69

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 3008	744	9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e.exe	69
PID 744 wrote to memory of 3008	744	9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e.exe	69
PID 744 wrote to memory of 3008	744	9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e.exe	69
PID 744 wrote to memory of 3008	744	9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e.exe	69
PID 744 wrote to memory of 3008	744	9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e.exe	69
PID 744 wrote to memory of 3008	744	9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e.exe	69
PID 744 wrote to memory of 3008	744	9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e.exe	69

C:\Users\Admin\AppData\Local\Temp\9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e.exe
"C:\Users\Admin\AppData\Local\Temp\9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:744
- C:\Users\Admin\AppData\Local\Temp\9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e.exe
  "C:\Users\Admin\AppData\Local\Temp\9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e.exe"
  2⤵
  - Executes dropped EXE
  PID:3008

memory/744-115-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/744-117-0x0000000005740000-0x0000000005741000-memory.dmp

Filesize
4KB

Download
memory/744-118-0x0000000005180000-0x0000000005182000-memory.dmp

Filesize
8KB

Download
memory/744-122-0x0000000005170000-0x0000000005171000-memory.dmp

Filesize
4KB

Download