795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 22:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe
Size

308KB
MD5

3eec3effb3244d5e201139d7955a9632
SHA1

a07c184b128c3158a3e3a07bb240acc7c7663f95
SHA256

795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c
SHA512

9db6f758e882df7e9ab0b34ece52a7848011ef162af6c4d66b605bf06608f0e0aa37c8a23fe0fe0ea8f7a97a11da587d354d59d9f49568fc96a2af946ac86dba
SSDEEP

6144:7RmuVoTCpYiODBz2p3hd7PoeetrTuRHGg4mt6nIFLt7:7vMCihQ3bDoee9MmgNt6IFL9

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe

description	pid	process	target process
PID 2784 set thread context of 2848	2784	795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe

description	pid	process	target process
PID 2784 wrote to memory of 2848	2784	795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe	RegAsm.exe
PID 2784 wrote to memory of 2848	2784	795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe	RegAsm.exe
PID 2784 wrote to memory of 2848	2784	795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe	RegAsm.exe
PID 2784 wrote to memory of 2848	2784	795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe	RegAsm.exe
PID 2784 wrote to memory of 2848	2784	795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe	RegAsm.exe
PID 2784 wrote to memory of 2848	2784	795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe	RegAsm.exe
PID 2784 wrote to memory of 2848	2784	795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe	RegAsm.exe
PID 2784 wrote to memory of 2848	2784	795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe	RegAsm.exe
PID 2784 wrote to memory of 2848	2784	795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe	RegAsm.exe
PID 2784 wrote to memory of 2848	2784	795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe	RegAsm.exe
PID 2784 wrote to memory of 2848	2784	795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe	RegAsm.exe
PID 2784 wrote to memory of 2848	2784	795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe	RegAsm.exe
PID 2784 wrote to memory of 2848	2784	795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe
"C:\Users\Admin\AppData\Local\Temp\795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2784-0-0x0000000001230000-0x0000000001284000-memory.dmp

Filesize
336KB

Download
memory/2784-3-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download
memory/2784-5-0x0000000002690000-0x0000000004690000-memory.dmp

Filesize
32.0MB

Download
memory/2784-15-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download
memory/2848-11-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2848-9-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2848-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2848-8-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2848-14-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2848-7-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2848-6-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2848-4-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2848-16-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download