Analysis

  • max time kernel
    10s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29/10/2022, 02:24

General

  • Target

    45588a043504b8047c2fed0cd8b54ca931b6eadec3749b2c0b494b8a649da755.exe

  • Size

    105KB

  • MD5

    f28546e6e56bb5e14d8585c10c449d72

  • SHA1

    33193e4fb572627c2fc2650efc873782cd0f69e7

  • SHA256

    45588a043504b8047c2fed0cd8b54ca931b6eadec3749b2c0b494b8a649da755

  • SHA512

    aa7d5dbd53cc87b07cd4355b3c13b58f161509b13d6f7824037480fccf108bcceaa310c6ee514b1fbad8d98f7cb9f5817f2f6a6275bbf84cd9ab240abaf562df

  • SSDEEP

    1536:DcxqwQZ0AK5AvN+AHvWEgoxiZ0200+rJuHvAV:MO8Nvm200WuP

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\45588a043504b8047c2fed0cd8b54ca931b6eadec3749b2c0b494b8a649da755.exe
    "C:\Users\Admin\AppData\Local\Temp\45588a043504b8047c2fed0cd8b54ca931b6eadec3749b2c0b494b8a649da755.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: MapViewOfSection
    PID:1388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1236-57-0x0000000076D10000-0x0000000076EB9000-memory.dmp

    Filesize

    1.7MB

  • memory/1388-54-0x0000000000400000-0x000000000140F000-memory.dmp

    Filesize

    16.1MB

  • memory/1388-55-0x0000000000400000-0x000000000140F000-memory.dmp

    Filesize

    16.1MB

  • memory/1388-56-0x0000000000400000-0x000000000140F000-memory.dmp

    Filesize

    16.1MB