48ac37a414b973602d31d5db441c5095b5f7c977310cdad784efebac5bf9630d | Triage

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2022 01:10

Sharing

Report Analysis Logs

General

Target

out21.exe
Size

72KB
MD5

9ef7fa437ae2c97ed78a4e688446ac3a
SHA1

7f6b0b04531927c58dfe0deed9090e1dee62b774
SHA256

c6d3166aa8bf663e3d3898cf3f59cfca5e7cf130fa881b010453327ee7f56679
SHA512

b60f62babaf13477a44794610f4a666576e04fc2e284815333b416021cd69a0917501ff15eb0ca834254f1e5402bc2e766489b8513aa21f157bb7a3cbe73cc80
SSDEEP

1536:Ipo4Djv3dUuLvlgSk2UEbVGf7HRR9szesGQQpHMb+KR0Nc8QsJq39:sXvZ6SksUf7xSeFpHe0Nc8QsC9

Score

1^/10

Malware Config

Signatures

Modifies registry class 1 IoCs

Processes:

calc.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings calc.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

2696 OpenWith.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

out21.exe

description	pid	process	target process
PID 1212 wrote to memory of 1956	1212	out21.exe	calc.exe
PID 1212 wrote to memory of 1956	1212	out21.exe	calc.exe
PID 1212 wrote to memory of 1956	1212	out21.exe	calc.exe

C:\Users\Admin\AppData\Local\Temp\out21.exe
"C:\Users\Admin\AppData\Local\Temp\out21.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1212

C:\Windows\SysWOW64\calc.exe
calc.exe
2⤵
- Modifies registry class
PID:1956

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1956-132-0x0000000000000000-mapping.dmp

Download