37773977416a09ae07d05dda3ecf488bba262436cd59a161f8189aeac5a35c81 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:52

Sharing

Report Analysis Logs

General

Target

sihost64.exe
Size

31KB
MD5

99f6ddfde83c4a40084b29ec309336c7
SHA1

7246f470c153a8c107fb4ff153da01f76c14db8e
SHA256

37773977416a09ae07d05dda3ecf488bba262436cd59a161f8189aeac5a35c81
SHA512

c488d00bf7678d4c28b392ddf8749cdef8875b0e451c4e7d1dcf214acbd15bfc2d71d6514c3e122a2dd7fc91aee9d4257d4551eeb12983a2858c14c8ddf23b95
SSDEEP

768:Qvr89iyH9Pk/O0lXg6VtsHOjog+5ipycYyk0f:G8wyVkm02arf

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

sihost64.exe

description	pid	process	target process
PID 1364 wrote to memory of 2156	1364	sihost64.exe	conhost.exe
PID 1364 wrote to memory of 2156	1364	sihost64.exe	conhost.exe
PID 1364 wrote to memory of 2156	1364	sihost64.exe	conhost.exe
PID 1364 wrote to memory of 2156	1364	sihost64.exe	conhost.exe

C:\Users\Admin\AppData\Local\Temp\sihost64.exe
"C:\Users\Admin\AppData\Local\Temp\sihost64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1364

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" "/sihost64"
2⤵
PID:2156

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2156-0-0x0000000000060000-0x0000000000066000-memory.dmp

Filesize
24KB

Download
memory/2156-1-0x000007FEF5EE3000-0x000007FEF5EE4000-memory.dmp

Filesize
4KB

Download
memory/2156-2-0x0000000001B40000-0x0000000001B46000-memory.dmp

Filesize
24KB

Download
memory/2156-4-0x000007FEF5EE0000-0x000007FEF68CC000-memory.dmp

Filesize
9.9MB

Download