Analysis

  • max time kernel
    43s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    30/10/2022, 12:31

General

  • Target

    9398c88b6b30fbb30565cb3cb4e71b1152996f81a8f3bebf2c37fe78159988b4.exe

  • Size

    112KB

  • MD5

    92f967a18639fa434b2c5e12f59b32d0

  • SHA1

    c231c1c0af329c9c208e92c592ad364e064b23f4

  • SHA256

    9398c88b6b30fbb30565cb3cb4e71b1152996f81a8f3bebf2c37fe78159988b4

  • SHA512

    e85c5495e3c4f9db87e81b21a709b10ed1c3479e45803cc85f0eac76cf7b35974299ca52eac68b84413e7167468a629193fc2d0704b6b14fb94be7c9860defc9

  • SSDEEP

    3072:aL3o6cA/cYCfr4veQ7Wb2dVAezFxeWOua:8Y6IfcWiTA+xeEa

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9398c88b6b30fbb30565cb3cb4e71b1152996f81a8f3bebf2c37fe78159988b4.exe
    "C:\Users\Admin\AppData\Local\Temp\9398c88b6b30fbb30565cb3cb4e71b1152996f81a8f3bebf2c37fe78159988b4.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: MapViewOfSection
    PID:1032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1032-54-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

  • memory/1032-55-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1032-56-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1032-57-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1232-58-0x0000000077B60000-0x0000000077D09000-memory.dmp

    Filesize

    1.7MB