6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7

Analysis

max time kernel
164s
max time network
169s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
04/03/2023, 22:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7.exe
Size

4.6MB
MD5

ea710d8b067b619aab99d1d6e6963cf4
SHA1

f8e9f4f1c03af1c4de7824f41560327eac848380
SHA256

6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7
SHA512

fb68ce046537a9654d1457fcebf683aa6452917b43d011970ab0e802a35fdda47a2b133900566595649ec38c40944e6421e6e6f694cc9d095921b2183f45b294
SSDEEP

98304:Gm2t3fy2VMLFDQ3lp9TgIpQ5cc+ltgm6Jfbn27nv0nm6xQPx:fb2VMQgYQ0ltgm6ZbXnmf5

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1808 set thread context of 4416	1808	6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7.exe	70

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 3412	1808	6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7.exe	67
PID 1808 wrote to memory of 3412	1808	6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7.exe	67
PID 1808 wrote to memory of 3412	1808	6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7.exe	67
PID 1808 wrote to memory of 2692	1808	6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7.exe	68
PID 1808 wrote to memory of 2692	1808	6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7.exe	68
PID 1808 wrote to memory of 2692	1808	6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7.exe	68
PID 1808 wrote to memory of 2696	1808	6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7.exe	69
PID 1808 wrote to memory of 2696	1808	6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7.exe	69
PID 1808 wrote to memory of 2696	1808	6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7.exe	69
PID 1808 wrote to memory of 4416	1808	6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7.exe	70
PID 1808 wrote to memory of 4416	1808	6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7.exe	70
PID 1808 wrote to memory of 4416	1808	6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7.exe	70
PID 1808 wrote to memory of 4416	1808	6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7.exe	70
PID 1808 wrote to memory of 4416	1808	6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7.exe	70

C:\Users\Admin\AppData\Local\Temp\6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7.exe
"C:\Users\Admin\AppData\Local\Temp\6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3412
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2692
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2696
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4416-122-0x0000000000400000-0x0000000000877000-memory.dmp

Filesize
4.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads