8f939a17b7cce53784b111ad018d932191e79305b5ae129347503b238f2274f7

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 22:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f939a17b7cce53784b111ad018d932191e79305b5ae129347503b238f2274f7_JC.exe
Size

631KB
MD5

e2e5fec0590ace89b05dbf61eb2440ab
SHA1

cb2d5518291bd2ccc9f5a29b98a5b597ed55edad
SHA256

8f939a17b7cce53784b111ad018d932191e79305b5ae129347503b238f2274f7
SHA512

b5dd76551fdda9421acbfcc2178bbf667bb262a9a3ad9dd82d1d374504479d92e22976695b264e96b1ed1a5253ba5cea40de0084ae80d4915d9281b3fbb7e249
SSDEEP

12288:brD60A+C9m5SdaCKXH1AHjCcz7lG45edvghw9dnNU0KK:XDv5SjKXuuyG6aJrBK

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2560 set thread context of 2672	2560	8f939a17b7cce53784b111ad018d932191e79305b5ae129347503b238f2274f7_JC.exe	30

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2672	8f939a17b7cce53784b111ad018d932191e79305b5ae129347503b238f2274f7_JC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2672	2560	8f939a17b7cce53784b111ad018d932191e79305b5ae129347503b238f2274f7_JC.exe	30
PID 2560 wrote to memory of 2672	2560	8f939a17b7cce53784b111ad018d932191e79305b5ae129347503b238f2274f7_JC.exe	30
PID 2560 wrote to memory of 2672	2560	8f939a17b7cce53784b111ad018d932191e79305b5ae129347503b238f2274f7_JC.exe	30
PID 2560 wrote to memory of 2672	2560	8f939a17b7cce53784b111ad018d932191e79305b5ae129347503b238f2274f7_JC.exe	30
PID 2560 wrote to memory of 2672	2560	8f939a17b7cce53784b111ad018d932191e79305b5ae129347503b238f2274f7_JC.exe	30
PID 2560 wrote to memory of 2672	2560	8f939a17b7cce53784b111ad018d932191e79305b5ae129347503b238f2274f7_JC.exe	30
PID 2560 wrote to memory of 2672	2560	8f939a17b7cce53784b111ad018d932191e79305b5ae129347503b238f2274f7_JC.exe	30

C:\Users\Admin\AppData\Local\Temp\8f939a17b7cce53784b111ad018d932191e79305b5ae129347503b238f2274f7_JC.exe
"C:\Users\Admin\AppData\Local\Temp\8f939a17b7cce53784b111ad018d932191e79305b5ae129347503b238f2274f7_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Users\Admin\AppData\Local\Temp\8f939a17b7cce53784b111ad018d932191e79305b5ae129347503b238f2274f7_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\8f939a17b7cce53784b111ad018d932191e79305b5ae129347503b238f2274f7_JC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2560-8-0x00000000057D0000-0x0000000005842000-memory.dmp

Filesize
456KB

Download
memory/2560-16-0x00000000744A0000-0x0000000074B8E000-memory.dmp

Filesize
6.9MB

Download
memory/2560-2-0x0000000004CD0000-0x0000000004D10000-memory.dmp

Filesize
256KB

Download
memory/2560-3-0x0000000001CE0000-0x0000000001CFA000-memory.dmp

Filesize
104KB

Download
memory/2560-4-0x00000000744A0000-0x0000000074B8E000-memory.dmp

Filesize
6.9MB

Download
memory/2560-5-0x0000000004CD0000-0x0000000004D10000-memory.dmp

Filesize
256KB

Download
memory/2560-6-0x0000000001D00000-0x0000000001D0A000-memory.dmp

Filesize
40KB

Download
memory/2560-7-0x0000000001D10000-0x0000000001D1C000-memory.dmp

Filesize
48KB

Download
memory/2560-1-0x00000000744A0000-0x0000000074B8E000-memory.dmp

Filesize
6.9MB

Download
memory/2560-0-0x0000000000350000-0x00000000003F4000-memory.dmp

Filesize
656KB

Download
memory/2672-9-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2672-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2672-15-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2672-11-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2672-18-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2672-17-0x00000000009A0000-0x0000000000CA3000-memory.dmp

Filesize
3.0MB

Download
memory/2672-19-0x00000000009A0000-0x0000000000CA3000-memory.dmp

Filesize
3.0MB

Download