068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce

General

Target

068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe
Size

114KB
MD5

9173148ca5304dd9b023744004d15657
SHA1

3bbdd49b5f79749bc99c347d69f62216e6b474de
SHA256

068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce
SHA512

00c4f73aa875b5520e9b0c36bb981be0890abd4ded4ce86a039d2951968ca37757ae39f98e7e9939b3db75a2d3803585690726033f5a827a7d4d7a06cb6434a1

Score

10^/10

suricata

suricata: ET MALWARE Generic - POST To .php w/Extended ASCII Characters
suricata: ET MALWARE Generic - POST To .php w/Extended ASCII Characters
suricata
suricata: ET MALWARE Ransomware Locky CnC Beacon 2
suricata: ET MALWARE Ransomware Locky CnC Beacon 2
suricata
suricata: ET MALWARE Win32/Necurs Common POST Header Structure
suricata: ET MALWARE Win32/Necurs Common POST Header Structure
suricata

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1640 set thread context of 1852	1640	068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1852	1640	068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe	28
PID 1640 wrote to memory of 1852	1640	068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe	28
PID 1640 wrote to memory of 1852	1640	068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe	28
PID 1640 wrote to memory of 1852	1640	068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe	28
PID 1640 wrote to memory of 1852	1640	068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe	28
PID 1640 wrote to memory of 1852	1640	068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe	28
PID 1640 wrote to memory of 1852	1640	068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe	28
PID 1640 wrote to memory of 1852	1640	068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe	28
PID 1640 wrote to memory of 1852	1640	068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe	28
PID 1640 wrote to memory of 1852	1640	068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe	28
PID 1640 wrote to memory of 1852	1640	068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe	28

C:\Users\Admin\AppData\Local\Temp\068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe
"C:\Users\Admin\AppData\Local\Temp\068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Users\Admin\AppData\Local\Temp\068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe
  "C:\Users\Admin\AppData\Local\Temp\068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe"
  2⤵
  PID:1852

memory/1852-54-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1852-56-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1852-58-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1852-57-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1852-55-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1852-60-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download
memory/1852-61-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1852-62-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1852-63-0x0000000000310000-0x0000000000331000-memory.dmp

Filesize
132KB

Download