ff620cac9b3476e186d435461d7ff49e95cd2655faedf4ebd4c6986186874ec1

Analysis

max time kernel
25s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 06:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff620cac9b3476e186d435461d7ff49e95cd2655faedf4ebd4c6986186874ec1.exe
Size

300KB
MD5

6b7283cae3e19d3b3d5abfbb7f7a8a30
SHA1

6c2f8f206b92c28b95b3a64456a7b9aa6e696e8c
SHA256

ff620cac9b3476e186d435461d7ff49e95cd2655faedf4ebd4c6986186874ec1
SHA512

c120d3e585d98742e9f1dae4d0a610fdd7660f0a6f5f5a89ef89bab252f8e6f44b4efb93a0411637af037008687550f8ca9d3918bc1a03a1267cab834cf5609b
SSDEEP

6144:vrc5Fz3pwghtLZU9UHIfEjzFmiCmQjh2RZDQQC3DQf/7jTe:Dc5Ugh3UqHMUzSmQjYAQCTuTe

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1676 set thread context of 632	1676	ff620cac9b3476e186d435461d7ff49e95cd2655faedf4ebd4c6986186874ec1.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1676	ff620cac9b3476e186d435461d7ff49e95cd2655faedf4ebd4c6986186874ec1.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 632	1676	ff620cac9b3476e186d435461d7ff49e95cd2655faedf4ebd4c6986186874ec1.exe	28
PID 1676 wrote to memory of 632	1676	ff620cac9b3476e186d435461d7ff49e95cd2655faedf4ebd4c6986186874ec1.exe	28
PID 1676 wrote to memory of 632	1676	ff620cac9b3476e186d435461d7ff49e95cd2655faedf4ebd4c6986186874ec1.exe	28
PID 1676 wrote to memory of 632	1676	ff620cac9b3476e186d435461d7ff49e95cd2655faedf4ebd4c6986186874ec1.exe	28
PID 1676 wrote to memory of 632	1676	ff620cac9b3476e186d435461d7ff49e95cd2655faedf4ebd4c6986186874ec1.exe	28
PID 1676 wrote to memory of 632	1676	ff620cac9b3476e186d435461d7ff49e95cd2655faedf4ebd4c6986186874ec1.exe	28
PID 1676 wrote to memory of 632	1676	ff620cac9b3476e186d435461d7ff49e95cd2655faedf4ebd4c6986186874ec1.exe	28
PID 1676 wrote to memory of 632	1676	ff620cac9b3476e186d435461d7ff49e95cd2655faedf4ebd4c6986186874ec1.exe	28
PID 1676 wrote to memory of 632	1676	ff620cac9b3476e186d435461d7ff49e95cd2655faedf4ebd4c6986186874ec1.exe	28

C:\Users\Admin\AppData\Local\Temp\ff620cac9b3476e186d435461d7ff49e95cd2655faedf4ebd4c6986186874ec1.exe
"C:\Users\Admin\AppData\Local\Temp\ff620cac9b3476e186d435461d7ff49e95cd2655faedf4ebd4c6986186874ec1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Users\Admin\AppData\Local\Temp\ff620cac9b3476e186d435461d7ff49e95cd2655faedf4ebd4c6986186874ec1.exe
  "C:\Users\Admin\AppData\Local\Temp\ff620cac9b3476e186d435461d7ff49e95cd2655faedf4ebd4c6986186874ec1.exe"
  2⤵
  PID:632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/632-71-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/632-81-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/632-80-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download
memory/632-77-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/632-75-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/632-74-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/632-72-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1676-62-0x00000000008B0000-0x00000000008B4000-memory.dmp

Filesize
16KB

Download
memory/1676-70-0x00000000008B0000-0x00000000008B4000-memory.dmp

Filesize
16KB

Download
memory/1676-69-0x00000000008B0000-0x00000000008B4000-memory.dmp

Filesize
16KB

Download
memory/1676-67-0x00000000008B0000-0x00000000008B4000-memory.dmp

Filesize
16KB

Download
memory/1676-66-0x00000000008B0000-0x00000000008B4000-memory.dmp

Filesize
16KB

Download
memory/1676-63-0x00000000008B0000-0x00000000008B4000-memory.dmp

Filesize
16KB

Download
memory/1676-56-0x00000000008B0000-0x00000000008B4000-memory.dmp

Filesize
16KB

Download
memory/1676-60-0x00000000008B0000-0x00000000008B4000-memory.dmp

Filesize
16KB

Download
memory/1676-59-0x00000000008B0000-0x00000000008B4000-memory.dmp

Filesize
16KB

Download
memory/1676-58-0x00000000008B0000-0x00000000008B4000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads