eb0b58a0ec2ae65ac9494bdfe5df965a26a5a72e1f79da4d3367079ed8898e41 | Triage

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 19:25

Sharing

Report Analysis Logs

General

Target

0d53e6444bb764478f3d0c894604f2eb.exe
Size

62KB
MD5

0d53e6444bb764478f3d0c894604f2eb
SHA1

71b5e47d1c6e8e188f81b35aa0ef7a247455d4e2
SHA256

eb0b58a0ec2ae65ac9494bdfe5df965a26a5a72e1f79da4d3367079ed8898e41
SHA512

4af5030746eeac809f95fdc5c93da23ced4aff921c8f08e3b883a174d03a91d44ea872b3862aa1fe06232dcc143f75b8efc50ef96b8cf67179af0051589ee392
SSDEEP

1536:2gkoOTi5HfgygwDOvCyFWLp27HzPVjnBwX3yl:2QZh3gwqvVWU7TQHyl

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4800 set thread context of 3028	4800	0d53e6444bb764478f3d0c894604f2eb.exe	20

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 3028	4800	0d53e6444bb764478f3d0c894604f2eb.exe	20
PID 4800 wrote to memory of 3028	4800	0d53e6444bb764478f3d0c894604f2eb.exe	20
PID 4800 wrote to memory of 3028	4800	0d53e6444bb764478f3d0c894604f2eb.exe	20
PID 4800 wrote to memory of 3028	4800	0d53e6444bb764478f3d0c894604f2eb.exe	20
PID 4800 wrote to memory of 3028	4800	0d53e6444bb764478f3d0c894604f2eb.exe	20
PID 4800 wrote to memory of 3028	4800	0d53e6444bb764478f3d0c894604f2eb.exe	20
PID 4800 wrote to memory of 3028	4800	0d53e6444bb764478f3d0c894604f2eb.exe	20
PID 4800 wrote to memory of 3028	4800	0d53e6444bb764478f3d0c894604f2eb.exe	20

C:\Users\Admin\AppData\Local\Temp\0d53e6444bb764478f3d0c894604f2eb.exe
"C:\Users\Admin\AppData\Local\Temp\0d53e6444bb764478f3d0c894604f2eb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Users\Admin\AppData\Local\Temp\0d53e6444bb764478f3d0c894604f2eb.exe
  C:\Users\Admin\AppData\Local\Temp\0d53e6444bb764478f3d0c894604f2eb.exe
  2⤵
  PID:3028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3028-3-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3028-2-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3028-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3028-5-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download