31606dbbf813ca5e00ef4d844c352f5d219259aa73f472edf0020adb5796d77d

Analysis

max time kernel
158s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2024 10:37

Target

cb30bc58445732712f2173ed5f9c0984.exe
Size

35KB
MD5

cb30bc58445732712f2173ed5f9c0984
SHA1

cc938a4d748a8d89b6bd0911c5864e40c706c821
SHA256

31606dbbf813ca5e00ef4d844c352f5d219259aa73f472edf0020adb5796d77d
SHA512

b48bad408c9d94b25236f3456ac024dd4672e89ac510695f0d7db1849577e6fd32047a21bcf8dac74aa2f9e1133d2751827ec7b25ec57c9ebb668fd2fe36f940
SSDEEP

768:rIKfXsh9PagyAtPchL1lCaW2g/CVGNvg+fJRBmUOZ0xtKxQcEyuE:rIKEh9CgykUbldW2gzg+fSSHw

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2604	reg.gin

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\reg.gin	cb30bc58445732712f2173ed5f9c0984.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 32 set thread context of 2604	32	cb30bc58445732712f2173ed5f9c0984.exe	90
PID 32 set thread context of 2604	32	cb30bc58445732712f2173ed5f9c0984.exe	90
PID 32 set thread context of 2604	32	cb30bc58445732712f2173ed5f9c0984.exe	90
PID 32 set thread context of 2604	32	cb30bc58445732712f2173ed5f9c0984.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 32 wrote to memory of 2604	32	cb30bc58445732712f2173ed5f9c0984.exe	90
PID 32 wrote to memory of 2604	32	cb30bc58445732712f2173ed5f9c0984.exe	90
PID 32 wrote to memory of 2604	32	cb30bc58445732712f2173ed5f9c0984.exe	90

C:\Users\Admin\AppData\Local\Temp\cb30bc58445732712f2173ed5f9c0984.exe
"C:\Users\Admin\AppData\Local\Temp\cb30bc58445732712f2173ed5f9c0984.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:32
- C:\Windows\SysWOW64\reg.gin
  "C:\Windows\system32\reg.gin"
  2⤵
  - Executes dropped EXE
  PID:2604

C:\Windows\SysWOW64\reg.gin

Filesize
1KB

MD5
bd0a3bac817b92bbc6acb974090179c6

SHA1
a6b33d69591f74f32ff3275fe1c998b0e617b393

SHA256
7da9ddeccf81a7d3f3825c878b3bf9987c5e822ef15885624869b50ec60d499f

SHA512
89e4f53caaaadf3f501e98d9ca84e38eafb7b0ac3d20aaf731d8ed33b7fe69f582bb97014e5ac8a46cb06a10413352b716b565a20828764d40d82c18473fcedd

Download Submit
memory/32-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download