65d38305a8b68c0a00cb7133612777acd4cc9f4c2e770cf4adbf392172a32227 | Triage

Resubmissions

18-07-2023 14:28

230718-rs27fsca5y 10

Analysis

max time kernel
66s
max time network
28s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
18-07-2023 14:28

Sharing

Report Analysis Logs

General

Target

ExtremeInvaders.exe
Size

651KB
MD5

b746ec336a45656a92d61da9c3816b05
SHA1

28f48c6dcccedd34f4b7dca393a0aba446f0d3f4
SHA256

4c48c5a35cf17c0fb3c05864681f7ed59728b7a51cd87940e92136e99ef4ac13
SHA512

a33b11f03ab250096f427824b3c5bfe0a384dfd1aca7f25b487d90a3b189879b3d08133d5007c2f30a1394fc2695bae591f38de0905ae96e6ef16141ae183b72
SSDEEP

3072:JQJ/VdFgIW9mYucJ/OD8JlsI90TIC7G2E1:a/7FG9mpcJ/OD8h/

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ExtremeInvaders.exe

pid process

1092 ExtremeInvaders.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ExtremeInvaders.exe

description	pid	process	target process
PID 1092 wrote to memory of 2672	1092	ExtremeInvaders.exe	UnityCrashHandler64.exe
PID 1092 wrote to memory of 2672	1092	ExtremeInvaders.exe	UnityCrashHandler64.exe
PID 1092 wrote to memory of 2672	1092	ExtremeInvaders.exe	UnityCrashHandler64.exe

C:\Users\Admin\AppData\Local\Temp\ExtremeInvaders.exe
"C:\Users\Admin\AppData\Local\Temp\ExtremeInvaders.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe
  "C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe" --attach 1092 528384
  2⤵
  PID:2672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1092-68-0x000007FFFFEC0000-0x000007FFFFED0000-memory.dmp

Filesize
64KB

Download
memory/1092-85-0x000007FFFFEB0000-0x000007FFFFEC0000-memory.dmp

Filesize
64KB

Download