77d0637c23e62aacd06cdae1199620955f5ef36ccd6b7de96f49ea6637f18ed5

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2023, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5a2f3553f03bea972618a4fc780146ab.exe
Size 640KB
Sample230907-lpb8zagc7v
SHA256 77d0637c23e62aacd06cdae1199620955f5ef36ccd6b7de96f49ea6637f18ed5
MD5 5a2f3553f03bea972618a4fc780146ab
SHA1 64f99d05aca898872289fc7b1ccde4bb6f703bb9
SHA512 c5d8a73e0931d194cc977c276b86231e8254e02009c5ca05308966692b3dc8574c3b5cd6d4db7fa9d146f6a0e87b6d65a043b0551b1c636136618b024d88e465
SSDEEP 12288:F5fVsbR2ZLqq2h8zMm8qslD4QBi4LYbOvCpbie7K3RJdTfIQ90ZE7HKS/S:FtO2ZLRD8LlD4UYbXI6KBJJfIB
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4248 set thread context of 3956	4248	5a2f3553f03bea972618a4fc780146ab.exe	89

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3956	5a2f3553f03bea972618a4fc780146ab.exe
3956	5a2f3553f03bea972618a4fc780146ab.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 3956	4248	5a2f3553f03bea972618a4fc780146ab.exe	89
PID 4248 wrote to memory of 3956	4248	5a2f3553f03bea972618a4fc780146ab.exe	89
PID 4248 wrote to memory of 3956	4248	5a2f3553f03bea972618a4fc780146ab.exe	89
PID 4248 wrote to memory of 3956	4248	5a2f3553f03bea972618a4fc780146ab.exe	89
PID 4248 wrote to memory of 3956	4248	5a2f3553f03bea972618a4fc780146ab.exe	89
PID 4248 wrote to memory of 3956	4248	5a2f3553f03bea972618a4fc780146ab.exe	89

C:\Users\Admin\AppData\Local\Temp\5a2f3553f03bea972618a4fc780146ab.exe
"C:\Users\Admin\AppData\Local\Temp\5a2f3553f03bea972618a4fc780146ab.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Users\Admin\AppData\Local\Temp\5a2f3553f03bea972618a4fc780146ab.exe
  "C:\Users\Admin\AppData\Local\Temp\5a2f3553f03bea972618a4fc780146ab.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3956-9-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/3956-13-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/3956-12-0x0000000001720000-0x0000000001A6A000-memory.dmp

Download

memory/4248-3-0x0000000005630000-0x00000000056C2000-memory.dmp

Download

memory/4248-4-0x0000000005610000-0x0000000005620000-memory.dmp

Download

memory/4248-5-0x00000000055B0000-0x00000000055BA000-memory.dmp

Download

memory/4248-6-0x0000000075060000-0x0000000075810000-memory.dmp

Download

memory/4248-7-0x0000000005610000-0x0000000005620000-memory.dmp

Download

memory/4248-8-0x0000000009460000-0x00000000094FC000-memory.dmp

Download

memory/4248-0-0x0000000000B10000-0x0000000000BB6000-memory.dmp

Download

memory/4248-11-0x0000000075060000-0x0000000075810000-memory.dmp

Download

memory/4248-2-0x0000000005BE0000-0x0000000006184000-memory.dmp

Download

memory/4248-1-0x0000000075060000-0x0000000075810000-memory.dmp

Download