48ac37a414b973602d31d5db441c5095b5f7c977310cdad784efebac5bf9630d | Triage

Analysis

max time kernel
130s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2022 01:10

Sharing

Report Analysis Logs

General

Target

out10.exe
Size

72KB
MD5

bc6a46e9f5e8569e07b0e9db822d2853
SHA1

ec05845cc65b30805f2ca4be8d68add3251407a2
SHA256

7d9415b6a84c8e60e15491eb3a1d9a2831682ae07f993ab46c0aa70377098320
SHA512

198741e0b69ca07e3a42688991bd1ba7ee334a4cb46c40817c0622483f672972320b6cd68372f03a70a94091ed3be762e24f119804a5fb432d7b81f0f2a04513
SSDEEP

1536:ICJA4PqtPVQ692z2DVL+CDTuMb+KR0Nc8QsJq39:WhPVQ692zQL5ue0Nc8QsC9

Score

1^/10

Malware Config

Signatures

Modifies registry class 1 IoCs

Processes:

calc.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings calc.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

4924 OpenWith.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

out10.exe

description	pid	process	target process
PID 4068 wrote to memory of 3132	4068	out10.exe	calc.exe
PID 4068 wrote to memory of 3132	4068	out10.exe	calc.exe
PID 4068 wrote to memory of 3132	4068	out10.exe	calc.exe

C:\Users\Admin\AppData\Local\Temp\out10.exe
"C:\Users\Admin\AppData\Local\Temp\out10.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4068

C:\Windows\SysWOW64\calc.exe
calc.exe
2⤵
- Modifies registry class
PID:3132

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3132-132-0x0000000000000000-mapping.dmp

Download