2dcaabc7567be2d913a8f0df7c972cc19d7ac220889f74342aa40cad5ec80f1d | Triage™

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
20/05/2022, 13:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
skazkalzt_crypted.exe
Size 1.2MB
Sample220520-q74hdsaack
SHA256 2dcaabc7567be2d913a8f0df7c972cc19d7ac220889f74342aa40cad5ec80f1d
MD5 a2db5ad04fb9d549f60a829a3293338a
SHA1 2c9cf498fd755b71d46b92bde62f06955d00aa7a
SHA512 36757aa52f416d9af09f06d2e2fc3ad7e78616ec7de81c29aad6391ef5b9bc6e77eebbdcc12e31257550f01b06ba9b502d4c151d5a37e8806192e098048a0719
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4060 set thread context of 4884	4060	skazkalzt_crypted.exe	85

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 4884	4060	skazkalzt_crypted.exe	85
PID 4060 wrote to memory of 4884	4060	skazkalzt_crypted.exe	85
PID 4060 wrote to memory of 4884	4060	skazkalzt_crypted.exe	85
PID 4060 wrote to memory of 4884	4060	skazkalzt_crypted.exe	85
PID 4060 wrote to memory of 4884	4060	skazkalzt_crypted.exe	85

C:\Users\Admin\AppData\Local\Temp\skazkalzt_crypted.exe
"C:\Users\Admin\AppData\Local\Temp\skazkalzt_crypted.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4884-131-0x0000000000400000-0x00000000004CA000-memory.dmp

Download

memory/4884-137-0x0000000000400000-0x00000000004CA000-memory.dmp

Download