18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 14:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe
Size

68KB
MD5

06e5a7eb6c87337d3fc00bbfe23d11aa
SHA1

ae7f84bffd97240773bd0cec54d135487297285c
SHA256

18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe
SHA512

1a320b067698a099c5c36908be007147778c301f75e285aca7670becc4133db2d8481a3ff158be2d84906ab564922a973f6921837ea41d045dc380080b23f5ad
SSDEEP

768:bZdIE6mCf+51bcgBH5T9Zztj7CzrWBTZXDuT+pxvPDgAiXKZC2p2ng4nGwcsn6:9pFmg5Tf9u8TZXcCvfA2p2nNWsn6

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1976 set thread context of 1876	1976	18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1876	18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe
1876	18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1876	1976	18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe	27
PID 1976 wrote to memory of 1876	1976	18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe	27
PID 1976 wrote to memory of 1876	1976	18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe	27
PID 1976 wrote to memory of 1876	1976	18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe	27
PID 1976 wrote to memory of 1876	1976	18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe	27
PID 1976 wrote to memory of 1876	1976	18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe	27
PID 1976 wrote to memory of 1876	1976	18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe	27
PID 1976 wrote to memory of 1876	1976	18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe	27
PID 1876 wrote to memory of 1288	1876	18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe	7
PID 1876 wrote to memory of 1288	1876	18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe	7
PID 1876 wrote to memory of 1288	1876	18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe	7
PID 1876 wrote to memory of 1288	1876	18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe	7

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1288
- C:\Users\Admin\AppData\Local\Temp\18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe
  "C:\Users\Admin\AppData\Local\Temp\18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Users\Admin\AppData\Local\Temp\18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe
    "C:\Users\Admin\AppData\Local\Temp\18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1876-7071-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1876-7070-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1876-7066-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1876-7064-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1976-79-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-83-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-63-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-65-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-67-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-66-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-68-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-69-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-71-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-70-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-72-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-73-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-74-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-76-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-77-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-78-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-80-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-54-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-81-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-82-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-84-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-64-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-85-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-86-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-88-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-87-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-89-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-90-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-98-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-101-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-102-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-103-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-105-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-106-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-107-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-109-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-62-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-61-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-56-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-57-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1976-55-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download