4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28

Analysis

Target

4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe
Size

119KB
MD5

42221a3c2ef7c0b9f5292ee5f6382fc7
SHA1

6621ab1500e25cc20601754f584e8197d493840a
SHA256

4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28
SHA512

1a970195f546cb9310c8bdaee7f1cadd12ebbbd7ef84fad0ed60000c36b8e198e230bcf244a7b2962408d70438c2e8064f4bdca9bedcfdb7dbb4e2bbc8be776e

Score

10^/10

suricata

suricata: ET MALWARE Generic - POST To .php w/Extended ASCII Characters
suricata: ET MALWARE Generic - POST To .php w/Extended ASCII Characters
suricata
suricata: ET MALWARE Ransomware Locky CnC Beacon 2
suricata: ET MALWARE Ransomware Locky CnC Beacon 2
suricata

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 752 set thread context of 2824	752	4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe	81

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 2824	752	4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe	81
PID 752 wrote to memory of 2824	752	4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe	81
PID 752 wrote to memory of 2824	752	4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe	81
PID 752 wrote to memory of 2824	752	4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe	81
PID 752 wrote to memory of 2824	752	4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe	81
PID 752 wrote to memory of 2824	752	4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe	81
PID 752 wrote to memory of 2824	752	4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe	81
PID 752 wrote to memory of 2824	752	4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe	81

C:\Users\Admin\AppData\Local\Temp\4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe
"C:\Users\Admin\AppData\Local\Temp\4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:752
- C:\Users\Admin\AppData\Local\Temp\4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe
  "C:\Users\Admin\AppData\Local\Temp\4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe"
  2⤵
  PID:2824

memory/2824-131-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2824-132-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2824-136-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2824-138-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2824-137-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2824-140-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download