d6024bfad7ada608f89fa3182721931c6a7342240d80f16781cb574d175ee945

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 03:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6024bfad7ada608f89fa3182721931c6a7342240d80f16781cb574d175ee945.exe
Size

310KB
MD5

63628adab7ad89cc3f30e14283bca090
SHA1

f01fcdc82f04d2db76fe866e29d9c491c65e9496
SHA256

d6024bfad7ada608f89fa3182721931c6a7342240d80f16781cb574d175ee945
SHA512

46c0d9e407caa248d9a64d9e90ccc77257a3195432c4854ddfce1ec015c49e7084da4d13ce64c01b0f341699681833cba6caff9f305d2a9cf419f439016a50b0
SSDEEP

6144:CPE6R+mX0FgmpETSmECEBurP+L8WHmWLmzF5EjtxRPan4acXuTq:CP7ImigudmEBBONGNsDEjgn45X

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

d6024bfad7ada608f89fa3182721931c6a7342240d80f16781cb574d175ee945.exe

description	pid	process	target process
PID 1544 set thread context of 2028	1544	d6024bfad7ada608f89fa3182721931c6a7342240d80f16781cb574d175ee945.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

d6024bfad7ada608f89fa3182721931c6a7342240d80f16781cb574d175ee945.exe

description	pid	process	target process
PID 1544 wrote to memory of 2028	1544	d6024bfad7ada608f89fa3182721931c6a7342240d80f16781cb574d175ee945.exe	RegAsm.exe
PID 1544 wrote to memory of 2028	1544	d6024bfad7ada608f89fa3182721931c6a7342240d80f16781cb574d175ee945.exe	RegAsm.exe
PID 1544 wrote to memory of 2028	1544	d6024bfad7ada608f89fa3182721931c6a7342240d80f16781cb574d175ee945.exe	RegAsm.exe
PID 1544 wrote to memory of 2028	1544	d6024bfad7ada608f89fa3182721931c6a7342240d80f16781cb574d175ee945.exe	RegAsm.exe
PID 1544 wrote to memory of 2028	1544	d6024bfad7ada608f89fa3182721931c6a7342240d80f16781cb574d175ee945.exe	RegAsm.exe
PID 1544 wrote to memory of 2028	1544	d6024bfad7ada608f89fa3182721931c6a7342240d80f16781cb574d175ee945.exe	RegAsm.exe
PID 1544 wrote to memory of 2028	1544	d6024bfad7ada608f89fa3182721931c6a7342240d80f16781cb574d175ee945.exe	RegAsm.exe
PID 1544 wrote to memory of 2028	1544	d6024bfad7ada608f89fa3182721931c6a7342240d80f16781cb574d175ee945.exe	RegAsm.exe
PID 1544 wrote to memory of 2028	1544	d6024bfad7ada608f89fa3182721931c6a7342240d80f16781cb574d175ee945.exe	RegAsm.exe
PID 1544 wrote to memory of 2028	1544	d6024bfad7ada608f89fa3182721931c6a7342240d80f16781cb574d175ee945.exe	RegAsm.exe
PID 1544 wrote to memory of 2028	1544	d6024bfad7ada608f89fa3182721931c6a7342240d80f16781cb574d175ee945.exe	RegAsm.exe
PID 1544 wrote to memory of 2028	1544	d6024bfad7ada608f89fa3182721931c6a7342240d80f16781cb574d175ee945.exe	RegAsm.exe
PID 1544 wrote to memory of 2028	1544	d6024bfad7ada608f89fa3182721931c6a7342240d80f16781cb574d175ee945.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\d6024bfad7ada608f89fa3182721931c6a7342240d80f16781cb574d175ee945.exe
"C:\Users\Admin\AppData\Local\Temp\d6024bfad7ada608f89fa3182721931c6a7342240d80f16781cb574d175ee945.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1544-0-0x0000000000E90000-0x0000000000EE4000-memory.dmp

Filesize
336KB

Download
memory/1544-1-0x0000000074920000-0x000000007500E000-memory.dmp

Filesize
6.9MB

Download
memory/1544-4-0x00000000022F0000-0x00000000042F0000-memory.dmp

Filesize
32.0MB

Download
memory/1544-15-0x0000000074920000-0x000000007500E000-memory.dmp

Filesize
6.9MB

Download
memory/2028-8-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2028-7-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2028-6-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2028-9-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2028-11-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2028-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2028-5-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2028-14-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2028-16-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2028-17-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download