mystic | 34136b82371bea657b3ed03813a88a5364864d49b02e43ad3559736d4890feeb

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2023, 17:07

Target

34136b82371bea657b3ed03813a88a5364864d49b02e43ad3559736d4890feeb.exe
Size

700KB
MD5

fceb1cdceb7000a6983124d893615129
SHA1

c807311a4c893949cd9a270399e29a63690eaf9f
SHA256

34136b82371bea657b3ed03813a88a5364864d49b02e43ad3559736d4890feeb
SHA512

ae1b849134d9e35f835be02223eb6cc1d4c7c1c77c32ee6c5e567a76fc0a203f61bd1a7db92f5c1ef017b3db8587b37f607bc4818fe4b88c5a0a69af72f504bd
SSDEEP

12288:eGfg2i8VucQ5H4A7eNqE+4cxCnWPPQY3Mgfz:1gG9AUqEZcxCnWHQY3Mgb

Score

10^/10

mystic stealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3224 set thread context of 1480	3224	34136b82371bea657b3ed03813a88a5364864d49b02e43ad3559736d4890feeb.exe	90

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3940	3224	WerFault.exe	86

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 1480	3224	34136b82371bea657b3ed03813a88a5364864d49b02e43ad3559736d4890feeb.exe	90
PID 3224 wrote to memory of 1480	3224	34136b82371bea657b3ed03813a88a5364864d49b02e43ad3559736d4890feeb.exe	90
PID 3224 wrote to memory of 1480	3224	34136b82371bea657b3ed03813a88a5364864d49b02e43ad3559736d4890feeb.exe	90
PID 3224 wrote to memory of 1480	3224	34136b82371bea657b3ed03813a88a5364864d49b02e43ad3559736d4890feeb.exe	90
PID 3224 wrote to memory of 1480	3224	34136b82371bea657b3ed03813a88a5364864d49b02e43ad3559736d4890feeb.exe	90
PID 3224 wrote to memory of 1480	3224	34136b82371bea657b3ed03813a88a5364864d49b02e43ad3559736d4890feeb.exe	90
PID 3224 wrote to memory of 1480	3224	34136b82371bea657b3ed03813a88a5364864d49b02e43ad3559736d4890feeb.exe	90
PID 3224 wrote to memory of 1480	3224	34136b82371bea657b3ed03813a88a5364864d49b02e43ad3559736d4890feeb.exe	90
PID 3224 wrote to memory of 1480	3224	34136b82371bea657b3ed03813a88a5364864d49b02e43ad3559736d4890feeb.exe	90
PID 3224 wrote to memory of 1480	3224	34136b82371bea657b3ed03813a88a5364864d49b02e43ad3559736d4890feeb.exe	90

C:\Users\Admin\AppData\Local\Temp\34136b82371bea657b3ed03813a88a5364864d49b02e43ad3559736d4890feeb.exe
"C:\Users\Admin\AppData\Local\Temp\34136b82371bea657b3ed03813a88a5364864d49b02e43ad3559736d4890feeb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 276
  2⤵
  - Program crash
  PID:3940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3224 -ip 3224
1⤵
PID:880

memory/1480-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1480-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1480-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1480-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1480-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download