5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 13:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe
Size

206KB
MD5

6bb3a89e3c0ec4348252a7bbf13cad60
SHA1

883fb85f9818bdf5b8b5166e8ede33c41f031336
SHA256

5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630
SHA512

1d7de5ff5bca4e0e56618ea506dc3c18f27c2ae010c89ba8245f599f87391f666e166534d1c70499db297eb6142362191018faeb5b6fc21b31af9d24985b8ceb
SSDEEP

6144:VuSrQ6L3wN12Y6mFm2J+tYJdZpdKWr659:QSrQ6LAn2Y6Om2CMdKWr6n

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1348 set thread context of 1236	1348	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	26
PID 1236 set thread context of 728	1236	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	27
PID 728 set thread context of 1944	728	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	28
PID 1944 set thread context of 1908	1944	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	29

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 1236	1348	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	26
PID 1348 wrote to memory of 1236	1348	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	26
PID 1348 wrote to memory of 1236	1348	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	26
PID 1348 wrote to memory of 1236	1348	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	26
PID 1348 wrote to memory of 1236	1348	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	26
PID 1348 wrote to memory of 1236	1348	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	26
PID 1348 wrote to memory of 1236	1348	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	26
PID 1348 wrote to memory of 1236	1348	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	26
PID 1348 wrote to memory of 1236	1348	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	26
PID 1348 wrote to memory of 1236	1348	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	26
PID 1348 wrote to memory of 1236	1348	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	26
PID 1236 wrote to memory of 728	1236	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	27
PID 1236 wrote to memory of 728	1236	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	27
PID 1236 wrote to memory of 728	1236	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	27
PID 1236 wrote to memory of 728	1236	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	27
PID 728 wrote to memory of 1944	728	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	28
PID 728 wrote to memory of 1944	728	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	28
PID 728 wrote to memory of 1944	728	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	28
PID 728 wrote to memory of 1944	728	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	28
PID 728 wrote to memory of 1944	728	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	28
PID 728 wrote to memory of 1944	728	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	28
PID 728 wrote to memory of 1944	728	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	28
PID 728 wrote to memory of 1944	728	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	28
PID 728 wrote to memory of 1944	728	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	28
PID 728 wrote to memory of 1944	728	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	28
PID 728 wrote to memory of 1944	728	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	28
PID 1944 wrote to memory of 1908	1944	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	29
PID 1944 wrote to memory of 1908	1944	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	29
PID 1944 wrote to memory of 1908	1944	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	29
PID 1944 wrote to memory of 1908	1944	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	29
PID 1944 wrote to memory of 1908	1944	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	29
PID 1944 wrote to memory of 1908	1944	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	29
PID 1944 wrote to memory of 1908	1944	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	29
PID 1944 wrote to memory of 1908	1944	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	29
PID 1944 wrote to memory of 1908	1944	5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe	29

C:\Users\Admin\AppData\Local\Temp\5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe
"C:\Users\Admin\AppData\Local\Temp\5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Users\Admin\AppData\Local\Temp\5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe
  "C:\Users\Admin\AppData\Local\Temp\5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Users\Admin\AppData\Local\Temp\5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe
    "C:\Users\Admin\AppData\Local\Temp\5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:728
  - - C:\Users\Admin\AppData\Local\Temp\5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe
      "C:\Users\Admin\AppData\Local\Temp\5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5f0541de45343850f940c7d66be9faea54efca5cc060970403595892f0569630.exe"
        5⤵
        
        PID:1908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1236-60-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1236-68-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1236-58-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1236-59-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1236-54-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1236-62-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1236-65-0x0000000074F41000-0x0000000074F43000-memory.dmp

Filesize
8KB

Download
memory/1236-66-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1236-55-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1236-57-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1908-82-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1908-86-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1908-85-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1908-83-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1908-88-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1908-93-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1908-94-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1944-90-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads