Analysis

  • max time kernel
    149s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-11-2022 01:10

General

  • Target

    out12.exe

  • Size

    72KB

  • MD5

    cec7fee9ab5614cca3417067bbd6b305

  • SHA1

    6df9111004d0a8f77056c4c9d20d2493315f03ba

  • SHA256

    f172c6ba8e0198f39d3acc07034e772c432fe63877435de7837ee56dc0bd7f9e

  • SHA512

    acfe23a7b2927117d5030d1239e72cadc8cf880b2cb9abe9d16eaaa80e2f4b978ca9cc62b937ecacb5bebd32b90672ef4b83b22e03448d2f3bae8d8c00bae725

  • SSDEEP

    1536:IBh/yJpH5+ImRf/Ml6sovqSPZXM1wO4BMb+KR0Nc8QsJq39:Mh/M/+I6f/MzCqSPySO4Be0Nc8QsC9

Score
1/10

Malware Config

Signatures

  • Modifies registry class 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\out12.exe
    "C:\Users\Admin\AppData\Local\Temp\out12.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1612
    • C:\Windows\SysWOW64\calc.exe
      calc.exe
      2⤵
      • Modifies registry class
      PID:2732
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2732-132-0x0000000000000000-mapping.dmp