mystic | 52f469a0572a23dad94cbbfcbdf47c57e6b54b1185fd6e161fe850e1031f565a

Analysis

max time kernel
127s
max time network
132s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
24/09/2023, 01:34

Target

52f469a0572a23dad94cbbfcbdf47c57e6b54b1185fd6e161fe850e1031f565a.exe
Size

364KB
MD5

c8d15c45da35a8af92ef012ecfa5e4b9
SHA1

81018b64a739e18b5debed4070bd60d263d23a4f
SHA256

52f469a0572a23dad94cbbfcbdf47c57e6b54b1185fd6e161fe850e1031f565a
SHA512

395881077999fbb8f95e0d74d0cd02c965e56b4b2c9a1454f36bad18e9d51401e157735048320c6a4a13994eb494637830250e53db074950663d3cab90d48c1d
SSDEEP

6144:E946fuYXChoQTjlFgLuCY1dRuAOwtA7Zb2eo7CDLuExu+LDCQ9T9p78g7uoS+DwE:EqYzXChdTbv1buPl2NAuExpqMhG13+Dg

Score

10^/10

mystic stealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2716 set thread context of 1216	2716	52f469a0572a23dad94cbbfcbdf47c57e6b54b1185fd6e161fe850e1031f565a.exe	70

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4136	2716	WerFault.exe	69

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 1216	2716	52f469a0572a23dad94cbbfcbdf47c57e6b54b1185fd6e161fe850e1031f565a.exe	70
PID 2716 wrote to memory of 1216	2716	52f469a0572a23dad94cbbfcbdf47c57e6b54b1185fd6e161fe850e1031f565a.exe	70
PID 2716 wrote to memory of 1216	2716	52f469a0572a23dad94cbbfcbdf47c57e6b54b1185fd6e161fe850e1031f565a.exe	70
PID 2716 wrote to memory of 1216	2716	52f469a0572a23dad94cbbfcbdf47c57e6b54b1185fd6e161fe850e1031f565a.exe	70
PID 2716 wrote to memory of 1216	2716	52f469a0572a23dad94cbbfcbdf47c57e6b54b1185fd6e161fe850e1031f565a.exe	70
PID 2716 wrote to memory of 1216	2716	52f469a0572a23dad94cbbfcbdf47c57e6b54b1185fd6e161fe850e1031f565a.exe	70
PID 2716 wrote to memory of 1216	2716	52f469a0572a23dad94cbbfcbdf47c57e6b54b1185fd6e161fe850e1031f565a.exe	70
PID 2716 wrote to memory of 1216	2716	52f469a0572a23dad94cbbfcbdf47c57e6b54b1185fd6e161fe850e1031f565a.exe	70
PID 2716 wrote to memory of 1216	2716	52f469a0572a23dad94cbbfcbdf47c57e6b54b1185fd6e161fe850e1031f565a.exe	70
PID 2716 wrote to memory of 1216	2716	52f469a0572a23dad94cbbfcbdf47c57e6b54b1185fd6e161fe850e1031f565a.exe	70

C:\Users\Admin\AppData\Local\Temp\52f469a0572a23dad94cbbfcbdf47c57e6b54b1185fd6e161fe850e1031f565a.exe
"C:\Users\Admin\AppData\Local\Temp\52f469a0572a23dad94cbbfcbdf47c57e6b54b1185fd6e161fe850e1031f565a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 232
  2⤵
  - Program crash
  PID:4136

memory/1216-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1216-3-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1216-4-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1216-5-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1216-6-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download