7b8c485b4575541c8b4cda89434a8ee080517ab20d2bb45e74336a955dffe477 | Triage

Analysis

max time kernel
144s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 04:54

Sharing

Report Analysis Logs

General

Target

28fb4aa80454be1523357ed71d97074a.exe
Size

246KB
MD5

28fb4aa80454be1523357ed71d97074a
SHA1

12ef5042e938cb857449134db3b9229f1f66d581
SHA256

7b8c485b4575541c8b4cda89434a8ee080517ab20d2bb45e74336a955dffe477
SHA512

01a20f46f240946d69b25279922e20ff1a782cfe29ff38201bc0c8c611857296d36672e680688d699fb0d4f1c98ef58e32a74c9e97a63a4272e4dd079bb7db0e
SSDEEP

6144:T5XUYDUV86yyqzDHSBJ7VlVCWtpCoS0pWd:9XUYDcGzuRC2pCoSl

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1236 set thread context of 3316	1236	28fb4aa80454be1523357ed71d97074a.exe	22

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1236	28fb4aa80454be1523357ed71d97074a.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 3316	1236	28fb4aa80454be1523357ed71d97074a.exe	22
PID 1236 wrote to memory of 3316	1236	28fb4aa80454be1523357ed71d97074a.exe	22
PID 1236 wrote to memory of 3316	1236	28fb4aa80454be1523357ed71d97074a.exe	22
PID 1236 wrote to memory of 3316	1236	28fb4aa80454be1523357ed71d97074a.exe	22
PID 1236 wrote to memory of 3316	1236	28fb4aa80454be1523357ed71d97074a.exe	22
PID 1236 wrote to memory of 3316	1236	28fb4aa80454be1523357ed71d97074a.exe	22
PID 1236 wrote to memory of 3316	1236	28fb4aa80454be1523357ed71d97074a.exe	22
PID 1236 wrote to memory of 3316	1236	28fb4aa80454be1523357ed71d97074a.exe	22

C:\Users\Admin\AppData\Local\Temp\28fb4aa80454be1523357ed71d97074a.exe
"C:\Users\Admin\AppData\Local\Temp\28fb4aa80454be1523357ed71d97074a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Users\Admin\AppData\Local\Temp\28fb4aa80454be1523357ed71d97074a.exe
  "C:\Users\Admin\AppData\Local\Temp\28fb4aa80454be1523357ed71d97074a.exe"
  2⤵
  PID:3316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3316-2-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3316-5-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3316-6-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3316-4-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download