Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    15-06-2024 17:47

General

  • Target

    SakuraaCastingModLoader_1.exe

  • Size

    13.8MB

  • MD5

    1ed98e2aa5685c02c6e901100353e556

  • SHA1

    5ac2b2ae4f91122a1d1722a4dd7e535077885a10

  • SHA256

    9fd82b4b337ef2dadc453aa0365b3f3fb372de592df7bae33a041e4f2698b54c

  • SHA512

    bcd43029cce581b3e776be5d1a58c89d0a752a12b04c2ac63939a9f94fd3190538cc873f6e0ff1910858c70d8c97f192ad2c5c39caa6bc94dcabde423024c945

  • SSDEEP

    393216:fftZJkZJH84iNGcGOrsN1Do840BvsDv2A7S:HtZJaJ7is3OYNTBK1S

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SakuraaCastingModLoader_1.exe
    "C:\Users\Admin\AppData\Local\Temp\SakuraaCastingModLoader_1.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:2892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2892-0-0x000000013F70D000-0x000000013FF34000-memory.dmp

    Filesize

    8.2MB

  • memory/2892-10-0x00000000775C0000-0x00000000775C2000-memory.dmp

    Filesize

    8KB

  • memory/2892-8-0x00000000775C0000-0x00000000775C2000-memory.dmp

    Filesize

    8KB

  • memory/2892-6-0x00000000775C0000-0x00000000775C2000-memory.dmp

    Filesize

    8KB

  • memory/2892-5-0x00000000775B0000-0x00000000775B2000-memory.dmp

    Filesize

    8KB

  • memory/2892-3-0x00000000775B0000-0x00000000775B2000-memory.dmp

    Filesize

    8KB

  • memory/2892-1-0x00000000775B0000-0x00000000775B2000-memory.dmp

    Filesize

    8KB

  • memory/2892-11-0x000000013F700000-0x0000000140CFC000-memory.dmp

    Filesize

    22.0MB

  • memory/2892-12-0x000000013F700000-0x0000000140CFC000-memory.dmp

    Filesize

    22.0MB

  • memory/2892-15-0x000000013F70D000-0x000000013FF34000-memory.dmp

    Filesize

    8.2MB

  • memory/2892-16-0x000000013F700000-0x0000000140CFC000-memory.dmp

    Filesize

    22.0MB