accb153830327075ce1b342d2199d07f330fea6fc95cff4099d2e07079a117fc | Triage

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220414-en
submitted
20-05-2022 13:23

Sharing

Report Analysis Logs

General

Target

SKM_C3350191107102300.exe
Size

1.3MB
MD5

4509f8b27545e3a27ee3bc66df679b7c
SHA1

0b3687916e09fdf8528e06670ab6ba7b0b72fdf3
SHA256

15d49746815865a2bc0eb51c3479cf49a1e3cff398479a31c935d1cfbb64d5f0
SHA512

f77331f04e958ba87a4ba1b927d28058ce382242bf2242636bf9e96101b4ac43ca49c557744d7a7df6a35ea7c314101ae40491edde643aa8894d656873d93d92

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

SKM_C3350191107102300.exe

description pid process target process

PID 1984 set thread context of 1052 1984 SKM_C3350191107102300.exe RegSvcs.ExE
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

SKM_C3350191107102300.exe

pid process

1984 SKM_C3350191107102300.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

SKM_C3350191107102300.exe

description	pid	process	target process
PID 1984 wrote to memory of 1052	1984	SKM_C3350191107102300.exe	RegSvcs.ExE
PID 1984 wrote to memory of 1052	1984	SKM_C3350191107102300.exe	RegSvcs.ExE
PID 1984 wrote to memory of 1052	1984	SKM_C3350191107102300.exe	RegSvcs.ExE
PID 1984 wrote to memory of 1052	1984	SKM_C3350191107102300.exe	RegSvcs.ExE
PID 1984 wrote to memory of 1052	1984	SKM_C3350191107102300.exe	RegSvcs.ExE
PID 1984 wrote to memory of 1052	1984	SKM_C3350191107102300.exe	RegSvcs.ExE
PID 1984 wrote to memory of 1052	1984	SKM_C3350191107102300.exe	RegSvcs.ExE
PID 1984 wrote to memory of 1052	1984	SKM_C3350191107102300.exe	RegSvcs.ExE

C:\Users\Admin\AppData\Local\Temp\SKM_C3350191107102300.exe
"C:\Users\Admin\AppData\Local\Temp\SKM_C3350191107102300.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.ExE
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.ExE"
2⤵
PID:1052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1052-57-0x00000000004B2E3E-mapping.dmp

Download