756e67609129019221c8efad0cb5bd4f9aec8bf5d4765b9c5164ecd08f7d83c3 | Triage

Analysis

max time kernel
135s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 05:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0f74a63a8495b09ae90a2fd28cba71c3.exe
Size

46KB
MD5

0f74a63a8495b09ae90a2fd28cba71c3
SHA1

400bf1082ca90e403060f9b30798ce52aff01e04
SHA256

756e67609129019221c8efad0cb5bd4f9aec8bf5d4765b9c5164ecd08f7d83c3
SHA512

a5806a9630f656f3dc9cdc950716b7c8fa71c1f1af3fce471654db6d97aee403fee047d4164b55526927f70adeb53dcbb8b1855e9976b2ae9d256640ae7348c2
SSDEEP

768:xVm8kLyvwd5D8VSBsfrR3FRQHdLTZFHIGdQ:DmxOYd5uaWk9LIGdQ

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1140 set thread context of 4240	1140	0f74a63a8495b09ae90a2fd28cba71c3.exe	88

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 4240	1140	0f74a63a8495b09ae90a2fd28cba71c3.exe	88
PID 1140 wrote to memory of 4240	1140	0f74a63a8495b09ae90a2fd28cba71c3.exe	88
PID 1140 wrote to memory of 4240	1140	0f74a63a8495b09ae90a2fd28cba71c3.exe	88
PID 1140 wrote to memory of 4240	1140	0f74a63a8495b09ae90a2fd28cba71c3.exe	88

C:\Users\Admin\AppData\Local\Temp\0f74a63a8495b09ae90a2fd28cba71c3.exe
"C:\Users\Admin\AppData\Local\Temp\0f74a63a8495b09ae90a2fd28cba71c3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Users\Admin\AppData\Local\Temp\0f74a63a8495b09ae90a2fd28cba71c3.exe
  "C:\Users\Admin\AppData\Local\Temp\0f74a63a8495b09ae90a2fd28cba71c3.exe"
  2⤵
  PID:4240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads