b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a

Analysis

max time kernel
140s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2023, 08:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a.exe
Size

604KB
MD5

e10fec549c39c3274dcda749ec3a7119
SHA1

467eb88366dd6778937cc682f2d0793bb8b8e4e2
SHA256

b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a
SHA512

4b383c6257569a1a8122bf0b6c82dba388a60f1238d692fbfb8239f0b6d55775b4fbb18e269f8a592d902f3c3b98f1b44a0e713c86ad298020ec326df3f2e97b
SSDEEP

12288:of1Qxpw8pplE3iifF2iRRv7lAscevzlfgzvulAvheD1P/wOwJ:Vxpw8CF7l9c25gzvulAc1/Z0

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4364 set thread context of 3608	4364	b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a.exe	91

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3608	b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a.exe
3608	b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 3608	4364	b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a.exe	91
PID 4364 wrote to memory of 3608	4364	b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a.exe	91
PID 4364 wrote to memory of 3608	4364	b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a.exe	91
PID 4364 wrote to memory of 3608	4364	b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a.exe	91
PID 4364 wrote to memory of 3608	4364	b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a.exe	91
PID 4364 wrote to memory of 3608	4364	b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a.exe	91

C:\Users\Admin\AppData\Local\Temp\b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a.exe
"C:\Users\Admin\AppData\Local\Temp\b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Users\Admin\AppData\Local\Temp\b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a.exe
  "C:\Users\Admin\AppData\Local\Temp\b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3608-13-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3608-17-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3608-16-0x0000000000EE0000-0x000000000122A000-memory.dmp

Filesize
3.3MB

Download
memory/4364-8-0x0000000074A80000-0x0000000075230000-memory.dmp

Filesize
7.7MB

Download
memory/4364-10-0x0000000005FB0000-0x0000000005FB8000-memory.dmp

Filesize
32KB

Download
memory/4364-5-0x0000000004EC0000-0x0000000004ECA000-memory.dmp

Filesize
40KB

Download
memory/4364-6-0x0000000005020000-0x00000000050BC000-memory.dmp

Filesize
624KB

Download
memory/4364-7-0x0000000004FC0000-0x0000000004FD2000-memory.dmp

Filesize
72KB

Download
memory/4364-0-0x0000000074A80000-0x0000000075230000-memory.dmp

Filesize
7.7MB

Download
memory/4364-9-0x0000000004F70000-0x0000000004F80000-memory.dmp

Filesize
64KB

Download
memory/4364-4-0x0000000004F70000-0x0000000004F80000-memory.dmp

Filesize
64KB

Download
memory/4364-11-0x0000000005FC0000-0x0000000005FCC000-memory.dmp

Filesize
48KB

Download
memory/4364-12-0x0000000005FE0000-0x000000000605A000-memory.dmp

Filesize
488KB

Download
memory/4364-3-0x0000000004D00000-0x0000000004D92000-memory.dmp

Filesize
584KB

Download
memory/4364-15-0x0000000074A80000-0x0000000075230000-memory.dmp

Filesize
7.7MB

Download
memory/4364-2-0x0000000005200000-0x00000000057A4000-memory.dmp

Filesize
5.6MB

Download
memory/4364-1-0x0000000000290000-0x000000000032C000-memory.dmp

Filesize
624KB

Download