e5e75423970d90ad62d6edd3d72ba04bd94e6b687f9348729e3416b173e660d6 | Triage

Analysis

max time kernel
128s
max time network
402s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 00:15

Sharing

Report Analysis Logs

General

Target

notification.exe
Size

57KB
MD5

310da20a626d85819d981eddeb32ed27
SHA1

119be6fd440e39db4b6dd2459b9b9a2cde938ec5
SHA256

cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729
SHA512

9afca8f0bc415b678e717c766457b7adde1d28107fafdbc6f75457845232a34f2bc1b6f764d3abed3893b1290a717b64e9508c34b8472d10a4277a5b779d1ad8
SSDEEP

768:Jf5kuRDCss6nA+MiS1RlY8IAtf0ey3+NAKY7ohturWfADGjS5qQDJ7w6:3k2DW+MHQAd0F3+NXcK5+Ei

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2532 set thread context of 3220	2532	notification.exe	80

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 3328	2532	notification.exe	79
PID 2532 wrote to memory of 3328	2532	notification.exe	79
PID 2532 wrote to memory of 3328	2532	notification.exe	79
PID 2532 wrote to memory of 3220	2532	notification.exe	80
PID 2532 wrote to memory of 3220	2532	notification.exe	80
PID 2532 wrote to memory of 3220	2532	notification.exe	80
PID 2532 wrote to memory of 3220	2532	notification.exe	80
PID 2532 wrote to memory of 3220	2532	notification.exe	80
PID 2532 wrote to memory of 3220	2532	notification.exe	80
PID 2532 wrote to memory of 3220	2532	notification.exe	80
PID 2532 wrote to memory of 3220	2532	notification.exe	80

C:\Users\Admin\AppData\Local\Temp\notification.exe
"C:\Users\Admin\AppData\Local\Temp\notification.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Users\Admin\AppData\Local\Temp\notification.exe
  "C:\Users\Admin\AppData\Local\Temp\notification.exe"
  2⤵
  PID:3328
- C:\Users\Admin\AppData\Local\Temp\notification.exe
  "C:\Users\Admin\AppData\Local\Temp\notification.exe"
  2⤵
  PID:3220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2532-132-0x0000000074710000-0x0000000074CC1000-memory.dmp

Filesize
5.7MB

Download
memory/2532-134-0x0000000074710000-0x0000000074CC1000-memory.dmp

Filesize
5.7MB

Download
memory/3220-135-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download