48ac37a414b973602d31d5db441c5095b5f7c977310cdad784efebac5bf9630d | Triage

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2022 01:10

Sharing

Report Analysis Logs

General

Target

out16.exe
Size

72KB
MD5

493e7a35a761f837e4ee2f984028ca3c
SHA1

b0ce5076a7861cce6b338ee083585558f2b142b7
SHA256

c2bc187d302d29e25dacd8034ca1dce97ea3b547c6a3d0087adfca31c618d519
SHA512

97f234277ad455ad8b3e3f85b67f23347be326349725f84af0b26312c7d48405b81de6be93b1c336f75bf6dc4ea16388193e532aba081f3fb5bac40344b94947
SSDEEP

1536:ISvUp/wvrZKMIqb2g9no6qofPWr6Mb+KR0Nc8QsJq39:HvKwtqqb2knJJU6e0Nc8QsC9

Score

1^/10

Malware Config

Signatures

Modifies registry class 1 IoCs

Processes:

calc.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings calc.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

4996 OpenWith.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

out16.exe

description	pid	process	target process
PID 3564 wrote to memory of 1796	3564	out16.exe	calc.exe
PID 3564 wrote to memory of 1796	3564	out16.exe	calc.exe
PID 3564 wrote to memory of 1796	3564	out16.exe	calc.exe

C:\Users\Admin\AppData\Local\Temp\out16.exe
"C:\Users\Admin\AppData\Local\Temp\out16.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3564

C:\Windows\SysWOW64\calc.exe
calc.exe
2⤵
- Modifies registry class
PID:1796

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1796-132-0x0000000000000000-mapping.dmp

Download