328454e937567ce37f549d85f303997a18c77ea9f47700212809e02321bd96bf | Triage

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2023 13:37

Sharing

Report Analysis Logs

General

Target

Picture47.JPG.scr
Size

165KB
MD5

caa0a13bd7ccf6af3241084e4c394647
SHA1

db0e58844b564bb70ab9547e258b55f08737dc78
SHA256

bdd822f9a0c5e69e3897d7feb4950ea58e1119ee5a656a55789c0827ee2bdce0
SHA512

50bb52758c88a5b40468d5a73977b688be1dd3ec3aecc157ab90f58733086503803b6c473d757c8051c580f4d68ceed82c4b68b89870ad67ace359e027744314
SSDEEP

3072:jgp5VH1kojjw70iESEDcaQhUxJnumqj12VDo0dzdo7MO:j4bMJE7DcJWxJpYH0Po7M

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 904 set thread context of 4620	904	Picture47.JPG.scr	78

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
904	Picture47.JPG.scr

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 4620	904	Picture47.JPG.scr	78
PID 904 wrote to memory of 4620	904	Picture47.JPG.scr	78
PID 904 wrote to memory of 4620	904	Picture47.JPG.scr	78

C:\Users\Admin\AppData\Local\Temp\Picture47.JPG.scr
"C:\Users\Admin\AppData\Local\Temp\Picture47.JPG.scr" /S
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:904
- C:\Users\Admin\AppData\Local\Temp\Picture47.JPG.scr
  "C:\Users\Admin\AppData\Local\Temp\Picture47.JPG.scr" /S
  2⤵
  PID:4620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4620-132-0x0000000000000000-mapping.dmp

Download