48ac37a414b973602d31d5db441c5095b5f7c977310cdad784efebac5bf9630d | Triage

Analysis

max time kernel
91s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2022 01:10

Sharing

Report Analysis Logs

General

Target

out18.exe
Size

72KB
MD5

7c569fc6edbb4818190c2fc6ce2cf8b4
SHA1

7aeb0a83f442a57646b43f451048da1135a6fa7a
SHA256

0622de553b2afdc9f204554bddaf51213c0bdfe38dafd390f69c6d83e114b7c8
SHA512

47055ee5971fd4ef2027b274d623c90762f62df5c45d429bfff53ef24a2966a3423b4aadb347b1a4d36fed9ec65da8b94fc47b65c847d65c6f1be1ac656a9ac3
SSDEEP

1536:IZXZfVeEafMQA6+kxPtZmcd53Hju/YxMb+KR0Nc8QsJq39:4ZfsAQPb/Fe0Nc8QsC9

Score

1^/10

Malware Config

Signatures

Modifies registry class 1 IoCs

Processes:

calc.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings calc.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

2248 OpenWith.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

out18.exe

description	pid	process	target process
PID 4640 wrote to memory of 2060	4640	out18.exe	calc.exe
PID 4640 wrote to memory of 2060	4640	out18.exe	calc.exe
PID 4640 wrote to memory of 2060	4640	out18.exe	calc.exe

C:\Users\Admin\AppData\Local\Temp\out18.exe
"C:\Users\Admin\AppData\Local\Temp\out18.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4640

C:\Windows\SysWOW64\calc.exe
calc.exe
2⤵
- Modifies registry class
PID:2060

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2060-132-0x0000000000000000-mapping.dmp

Download