Analysis
-
max time kernel
236s -
max time network
256s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
06-10-2022 03:43
Static task
static1
Behavioral task
behavioral1
Sample
89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe
Resource
win7-20220901-en
windows7-x64
3 signatures
300 seconds
General
-
Target
89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe
-
Size
345KB
-
MD5
8ee9351a60a4d89e0ff61b3789bcb98a
-
SHA1
b24279aa0c63143c6f89c7ca7ffc2d9d0c9d23a7
-
SHA256
89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c
-
SHA512
db031b525c1bfc9102b0ddc485612e9e46fb22fa27170f7f4df65d1817f5045845c4f3f3d8ddb3d5f5f25fe9fb4de31047b224752216e1b1546590aab21883b4
-
SSDEEP
6144:K6S1ZVlum8KDJUOER/YM58yC4ohdFrmHJJybheuo5cLol:oPmcUOIeyC4oZMJv5
Score
8/10
Malware Config
Signatures
-
Downloads MZ/PE file
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exedescription pid process target process PID 2024 set thread context of 980 2024 89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe RegSvcs.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exedescription pid process target process PID 2024 wrote to memory of 980 2024 89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe RegSvcs.exe PID 2024 wrote to memory of 980 2024 89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe RegSvcs.exe PID 2024 wrote to memory of 980 2024 89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe RegSvcs.exe PID 2024 wrote to memory of 980 2024 89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe RegSvcs.exe PID 2024 wrote to memory of 980 2024 89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe RegSvcs.exe PID 2024 wrote to memory of 980 2024 89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe RegSvcs.exe PID 2024 wrote to memory of 980 2024 89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe RegSvcs.exe PID 2024 wrote to memory of 980 2024 89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe RegSvcs.exe PID 2024 wrote to memory of 980 2024 89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe RegSvcs.exe PID 2024 wrote to memory of 980 2024 89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe RegSvcs.exe PID 2024 wrote to memory of 980 2024 89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe RegSvcs.exe PID 2024 wrote to memory of 980 2024 89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe"C:\Users\Admin\AppData\Local\Temp\89526174deb39bd6ef0663db7468763c54e30875591c8466281709c7d4f42d3c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/980-54-0x0000000140000000-0x0000000140023000-memory.dmpFilesize
140KB
-
memory/980-55-0x0000000140000000-0x0000000140023000-memory.dmpFilesize
140KB
-
memory/980-57-0x0000000140000000-0x0000000140023000-memory.dmpFilesize
140KB
-
memory/980-59-0x0000000140000000-0x0000000140023000-memory.dmpFilesize
140KB
-
memory/980-60-0x0000000140000000-0x0000000140023000-memory.dmpFilesize
140KB
-
memory/980-62-0x0000000140000000-0x0000000140023000-memory.dmpFilesize
140KB
-
memory/980-63-0x0000000140000000-0x0000000140023000-memory.dmpFilesize
140KB
-
memory/980-64-0x0000000140000000-0x0000000140023000-memory.dmpFilesize
140KB
-
memory/980-65-0x0000000140000000-0x0000000140023000-memory.dmpFilesize
140KB
-
memory/980-66-0x0000000140003FAC-mapping.dmp
-
memory/980-68-0x0000000140000000-0x0000000140023000-memory.dmpFilesize
140KB
-
memory/980-69-0x0000000140000000-0x0000000140023000-memory.dmpFilesize
140KB
-
memory/980-70-0x000007FEFC2F1000-0x000007FEFC2F3000-memory.dmpFilesize
8KB