48ac37a414b973602d31d5db441c5095b5f7c977310cdad784efebac5bf9630d | Triage

Analysis

max time kernel
90s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2022 01:10

Sharing

Report Analysis Logs

General

Target

out15.exe
Size

72KB
MD5

971e7217c194ef2141557e2186559228
SHA1

049acf6590a689979b1d04cdfe36fbcc24af287b
SHA256

ea40bb474274c8ea7d030afd6b6d26f15993b20878857492d5eafe1c477c3650
SHA512

1e69d9f5cb15f707498ec198ac853171cb1830dfc9036a0b2f46f381b8223dec64ff4b491ba4284692bed9b1a97b46e429f94ecd439467088f9eff26653664af
SSDEEP

1536:IAdTXVGK+HF+dtpsVq7OpIg4t0BMb+KR0Nc8QsJq39:zOZ+eqKpIn0Be0Nc8QsC9

Score

1^/10

Malware Config

Signatures

Modifies registry class 1 IoCs

Processes:

calc.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings calc.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

4992 OpenWith.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

out15.exe

description	pid	process	target process
PID 1180 wrote to memory of 4984	1180	out15.exe	calc.exe
PID 1180 wrote to memory of 4984	1180	out15.exe	calc.exe
PID 1180 wrote to memory of 4984	1180	out15.exe	calc.exe

C:\Users\Admin\AppData\Local\Temp\out15.exe
"C:\Users\Admin\AppData\Local\Temp\out15.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1180

C:\Windows\SysWOW64\calc.exe
calc.exe
2⤵
- Modifies registry class
PID:4984

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4984-132-0x0000000000000000-mapping.dmp

Download