f0241066d7993c81f6b1d073f4596ff948b9e590efddd22213c430197b644197

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 11:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0241066d7993c81f6b1d073f4596ff948b9e590efddd22213c430197b644197.exe
Size

87KB
MD5

0a7e85f38c9ff7eb185df3c32ee3326d
SHA1

81d9a88337a9309c2e40fa416aedd645f2405b82
SHA256

f0241066d7993c81f6b1d073f4596ff948b9e590efddd22213c430197b644197
SHA512

bbc67deb163a587ea38024674a92f602e2dee5886bc337e6b2f60578892663d349d65405e9b4fd068677a7d46630aa3488025d14e58315128dd5e806ddef56af
SSDEEP

1536:MBf4lXVB1WRydFMQaKBZRS30tJK4owAFmPE3TGBt3g4OoPdyCdGij4wHjxhLqkG6:MBYZPHOmP4Et3giRdGi0KjxYkT

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1088 set thread context of 308	1088	f0241066d7993c81f6b1d073f4596ff948b9e590efddd22213c430197b644197.exe	28
PID 1088 set thread context of 1856	1088	f0241066d7993c81f6b1d073f4596ff948b9e590efddd22213c430197b644197.exe	29

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 308	1088	f0241066d7993c81f6b1d073f4596ff948b9e590efddd22213c430197b644197.exe	28
PID 1088 wrote to memory of 308	1088	f0241066d7993c81f6b1d073f4596ff948b9e590efddd22213c430197b644197.exe	28
PID 1088 wrote to memory of 308	1088	f0241066d7993c81f6b1d073f4596ff948b9e590efddd22213c430197b644197.exe	28
PID 1088 wrote to memory of 308	1088	f0241066d7993c81f6b1d073f4596ff948b9e590efddd22213c430197b644197.exe	28
PID 1088 wrote to memory of 308	1088	f0241066d7993c81f6b1d073f4596ff948b9e590efddd22213c430197b644197.exe	28
PID 1088 wrote to memory of 308	1088	f0241066d7993c81f6b1d073f4596ff948b9e590efddd22213c430197b644197.exe	28
PID 1088 wrote to memory of 308	1088	f0241066d7993c81f6b1d073f4596ff948b9e590efddd22213c430197b644197.exe	28
PID 1088 wrote to memory of 308	1088	f0241066d7993c81f6b1d073f4596ff948b9e590efddd22213c430197b644197.exe	28
PID 1088 wrote to memory of 1856	1088	f0241066d7993c81f6b1d073f4596ff948b9e590efddd22213c430197b644197.exe	29
PID 1088 wrote to memory of 1856	1088	f0241066d7993c81f6b1d073f4596ff948b9e590efddd22213c430197b644197.exe	29
PID 1088 wrote to memory of 1856	1088	f0241066d7993c81f6b1d073f4596ff948b9e590efddd22213c430197b644197.exe	29
PID 1088 wrote to memory of 1856	1088	f0241066d7993c81f6b1d073f4596ff948b9e590efddd22213c430197b644197.exe	29
PID 1088 wrote to memory of 1856	1088	f0241066d7993c81f6b1d073f4596ff948b9e590efddd22213c430197b644197.exe	29
PID 1088 wrote to memory of 1856	1088	f0241066d7993c81f6b1d073f4596ff948b9e590efddd22213c430197b644197.exe	29
PID 1088 wrote to memory of 1856	1088	f0241066d7993c81f6b1d073f4596ff948b9e590efddd22213c430197b644197.exe	29
PID 1088 wrote to memory of 1856	1088	f0241066d7993c81f6b1d073f4596ff948b9e590efddd22213c430197b644197.exe	29

C:\Users\Admin\AppData\Local\Temp\f0241066d7993c81f6b1d073f4596ff948b9e590efddd22213c430197b644197.exe
"C:\Users\Admin\AppData\Local\Temp\f0241066d7993c81f6b1d073f4596ff948b9e590efddd22213c430197b644197.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Users\Admin\AppData\Local\Temp\f0241066d7993c81f6b1d073f4596ff948b9e590efddd22213c430197b644197.exe
  "C:\Users\Admin\AppData\Local\Temp\f0241066d7993c81f6b1d073f4596ff948b9e590efddd22213c430197b644197.exe"
  2⤵
  PID:308
- C:\Users\Admin\AppData\Local\Temp\f0241066d7993c81f6b1d073f4596ff948b9e590efddd22213c430197b644197.exe
  "C:\Users\Admin\AppData\Local\Temp\f0241066d7993c81f6b1d073f4596ff948b9e590efddd22213c430197b644197.exe"
  2⤵
  PID:1856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/308-55-0x00000000004A0000-0x00000000004AD000-memory.dmp

Filesize
52KB

Download
memory/308-56-0x00000000004A0000-0x00000000004AD000-memory.dmp

Filesize
52KB

Download
memory/308-58-0x00000000004A0000-0x00000000004AD000-memory.dmp

Filesize
52KB

Download
memory/308-60-0x00000000004A0000-0x00000000004AD000-memory.dmp

Filesize
52KB

Download
memory/308-62-0x00000000004A6E69-mapping.dmp

Download
memory/1088-54-0x0000000074D61000-0x0000000074D63000-memory.dmp

Filesize
8KB

Download
memory/1088-71-0x0000000019140000-0x0000000019159000-memory.dmp

Filesize
100KB

Download
memory/1856-63-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1856-64-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1856-66-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1856-68-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1856-70-0x00000000004010B0-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads