5e37da365fd3b6ba06283a977b9940d50c51ef66aac7bd20d1f2894cbe45f0fc | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 22:03

Sharing

Report Analysis Logs

General

Target

051b6f3c39d8696f8fcd23130a577d7f.exe
Size

58KB
MD5

051b6f3c39d8696f8fcd23130a577d7f
SHA1

e418d79a18f51b45197a1e0b608e8d9159c0e73d
SHA256

5e37da365fd3b6ba06283a977b9940d50c51ef66aac7bd20d1f2894cbe45f0fc
SHA512

a9141ed4566740176bf4e5abbd98e1f3af10aa0b4f99be5f09f907f736080676838e91f3274e4d6a1cbf3de898a1756f25053ec290e0ed597c30032031db9eb2
SSDEEP

1536:IgEnakJtmRLoPSzJDh2XEpP8eSVzJ80e2Xt9fK3ULZYu:9EXvmpxw0FHZ0TXlWu

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3000 set thread context of 3004	3000	051b6f3c39d8696f8fcd23130a577d7f.exe	16

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 3004	3000	051b6f3c39d8696f8fcd23130a577d7f.exe	16
PID 3000 wrote to memory of 3004	3000	051b6f3c39d8696f8fcd23130a577d7f.exe	16
PID 3000 wrote to memory of 3004	3000	051b6f3c39d8696f8fcd23130a577d7f.exe	16
PID 3000 wrote to memory of 3004	3000	051b6f3c39d8696f8fcd23130a577d7f.exe	16
PID 3000 wrote to memory of 3004	3000	051b6f3c39d8696f8fcd23130a577d7f.exe	16
PID 3000 wrote to memory of 3004	3000	051b6f3c39d8696f8fcd23130a577d7f.exe	16

C:\Users\Admin\AppData\Local\Temp\051b6f3c39d8696f8fcd23130a577d7f.exe
"C:\Users\Admin\AppData\Local\Temp\051b6f3c39d8696f8fcd23130a577d7f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Users\Admin\AppData\Local\Temp\051b6f3c39d8696f8fcd23130a577d7f.exe
  "C:\Users\Admin\AppData\Local\Temp\051b6f3c39d8696f8fcd23130a577d7f.exe"
  2⤵
  PID:3004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3000-5-0x0000000013140000-0x0000000013156000-memory.dmp

Filesize
88KB

Download
memory/3004-4-0x0000000013140000-0x0000000013140000-memory.dmp

Download
memory/3004-3-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3004-2-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3004-0-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download