mystic | d7527d5320a8697445823c3b11c2f6f38effc7de043ebff70d2e6b9a4e878f58

Analysis

max time kernel
70s
max time network
78s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
02-10-2023 12:43

Target

d7527d5320a8697445823c3b11c2f6f38effc7de043ebff70d2e6b9a4e878f58.exe
Size

285KB
MD5

db9a1ee828105bfaabd04565eceb9ebe
SHA1

47fe68d6e249d905f01c6c858f021e4b5cbaaec4
SHA256

d7527d5320a8697445823c3b11c2f6f38effc7de043ebff70d2e6b9a4e878f58
SHA512

ba2a6ec10f636199617a7a67d2d0c68279842237fca23867232e73554b82c76bae393285d6b25cefa10e2268fc865051472d8959c5455f826758144a32ace59e
SSDEEP

6144:kU+Elo4WGFw16Hc4dqXrw0NVvxFtbhjjTm6J0xfp6qrJox:kU+ElodKHc4dqXrwkvn7jTm6J6B6q2x

Score

10^/10

mystic stealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2340 set thread context of 4536	2340	d7527d5320a8697445823c3b11c2f6f38effc7de043ebff70d2e6b9a4e878f58.exe	72

Program crash 1 IoCs

pid	pid_target	Process	procid_target
216	2340	WerFault.exe	70

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 4536	2340	d7527d5320a8697445823c3b11c2f6f38effc7de043ebff70d2e6b9a4e878f58.exe	72
PID 2340 wrote to memory of 4536	2340	d7527d5320a8697445823c3b11c2f6f38effc7de043ebff70d2e6b9a4e878f58.exe	72
PID 2340 wrote to memory of 4536	2340	d7527d5320a8697445823c3b11c2f6f38effc7de043ebff70d2e6b9a4e878f58.exe	72
PID 2340 wrote to memory of 4536	2340	d7527d5320a8697445823c3b11c2f6f38effc7de043ebff70d2e6b9a4e878f58.exe	72
PID 2340 wrote to memory of 4536	2340	d7527d5320a8697445823c3b11c2f6f38effc7de043ebff70d2e6b9a4e878f58.exe	72
PID 2340 wrote to memory of 4536	2340	d7527d5320a8697445823c3b11c2f6f38effc7de043ebff70d2e6b9a4e878f58.exe	72
PID 2340 wrote to memory of 4536	2340	d7527d5320a8697445823c3b11c2f6f38effc7de043ebff70d2e6b9a4e878f58.exe	72
PID 2340 wrote to memory of 4536	2340	d7527d5320a8697445823c3b11c2f6f38effc7de043ebff70d2e6b9a4e878f58.exe	72
PID 2340 wrote to memory of 4536	2340	d7527d5320a8697445823c3b11c2f6f38effc7de043ebff70d2e6b9a4e878f58.exe	72
PID 2340 wrote to memory of 4536	2340	d7527d5320a8697445823c3b11c2f6f38effc7de043ebff70d2e6b9a4e878f58.exe	72

C:\Users\Admin\AppData\Local\Temp\d7527d5320a8697445823c3b11c2f6f38effc7de043ebff70d2e6b9a4e878f58.exe
"C:\Users\Admin\AppData\Local\Temp\d7527d5320a8697445823c3b11c2f6f38effc7de043ebff70d2e6b9a4e878f58.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 352
  2⤵
  - Program crash
  PID:216

memory/4536-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4536-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4536-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4536-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4536-6-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download