29a1b2044662e0dd7f3059854ed7d49d2511eca878ecf4aad8664292e62dd2d5

Analysis

max time kernel
30s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04-06-2024 22:15

Target

Small Malwares/1000009001/lumma123.exe
Size

499KB
MD5

5161d6c2af56a358e4d00d3d50b3cafb
SHA1

0c506ae0b84539524ba32551f2f297340692c72a
SHA256

7aa5344aab15b3fb2355c59e09b7071a6a0a12ec1a5828367ecb7e9f926fe765
SHA512

c981aafb0e901838b1ccacda32f9b026995d5fd8cbed6590f2b3dd1178a2751065194a872c22cf24475eaf963c464916e33dd0fc620723d79b7f25d0e5041441
SSDEEP

12288:RlY3R4zdWR5YkPebLhYWT3+Kw6RDubFagn8H4:Rleqz3kW1KKlRsw

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

lumma123.exe

description pid process target process

PID 1600 set thread context of 1572 1600 lumma123.exe RegAsm.exe

description	pid	process	target process
PID 1600 set thread context of 1572	1600	lumma123.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

lumma123.exe

description	pid	process	target process
PID 1600 wrote to memory of 1572	1600	lumma123.exe	RegAsm.exe
PID 1600 wrote to memory of 1572	1600	lumma123.exe	RegAsm.exe
PID 1600 wrote to memory of 1572	1600	lumma123.exe	RegAsm.exe
PID 1600 wrote to memory of 1572	1600	lumma123.exe	RegAsm.exe
PID 1600 wrote to memory of 1572	1600	lumma123.exe	RegAsm.exe
PID 1600 wrote to memory of 1572	1600	lumma123.exe	RegAsm.exe
PID 1600 wrote to memory of 1572	1600	lumma123.exe	RegAsm.exe
PID 1600 wrote to memory of 1572	1600	lumma123.exe	RegAsm.exe
PID 1600 wrote to memory of 1572	1600	lumma123.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\Small Malwares\1000009001\lumma123.exe
"C:\Users\Admin\AppData\Local\Temp\Small Malwares\1000009001\lumma123.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1572

memory/1572-1-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1572-5-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1572-4-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1600-0-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1600-2-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download