8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe
Size

308KB
MD5

818b475b766c54df6d845cb10b6eedcf
SHA1

69ba418b84f5eb0930ba483c8fb1d8416b0b8749
SHA256

8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478
SHA512

93371ece9326b2e88425c01d4f6f7dcc19ae5ee252295d8ddf283bc21ae4f5a72761b0f3ae1204dc85fcd1a11096ccd6c3af4b9e6a85ad9833e8cb06b85c5ca4
SSDEEP

6144:YsFFiBD/2f50sJknDeebx5pAsqL3N8MYk7ZA9k+AEGYeBTNEV:0ghHunDeebx5U2MYkZDEGYeBTiV

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe

description	pid	process	target process
PID 2336 set thread context of 2988	2336	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe

description	pid	process	target process
PID 2336 wrote to memory of 2936	2336	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe
PID 2336 wrote to memory of 2936	2336	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe
PID 2336 wrote to memory of 2936	2336	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe
PID 2336 wrote to memory of 2936	2336	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe
PID 2336 wrote to memory of 2936	2336	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe
PID 2336 wrote to memory of 2936	2336	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe
PID 2336 wrote to memory of 2936	2336	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe
PID 2336 wrote to memory of 2988	2336	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe
PID 2336 wrote to memory of 2988	2336	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe
PID 2336 wrote to memory of 2988	2336	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe
PID 2336 wrote to memory of 2988	2336	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe
PID 2336 wrote to memory of 2988	2336	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe
PID 2336 wrote to memory of 2988	2336	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe
PID 2336 wrote to memory of 2988	2336	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe
PID 2336 wrote to memory of 2988	2336	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe
PID 2336 wrote to memory of 2988	2336	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe
PID 2336 wrote to memory of 2988	2336	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe
PID 2336 wrote to memory of 2988	2336	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe
PID 2336 wrote to memory of 2988	2336	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe
PID 2336 wrote to memory of 2988	2336	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe
"C:\Users\Admin\AppData\Local\Temp\8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2336

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:2936

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:2988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2336-0-0x0000000000B00000-0x0000000000B54000-memory.dmp

Filesize
336KB

Download
memory/2336-2-0x0000000074EA0000-0x000000007558E000-memory.dmp

Filesize
6.9MB

Download
memory/2336-4-0x0000000002350000-0x0000000004350000-memory.dmp

Filesize
32.0MB

Download
memory/2336-15-0x0000000074EA0000-0x000000007558E000-memory.dmp

Filesize
6.9MB

Download
memory/2988-9-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2988-6-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2988-7-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2988-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2988-8-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2988-11-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2988-14-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2988-5-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2988-16-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2988-17-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download