7e4f079821c66e7ff07526d6420db7fa4df2f810536774a3f5b67101e05edc92

Analysis

max time kernel
151s
max time network
129s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 08:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e4f079821c66e7ff07526d6420db7fa4df2f810536774a3f5b67101e05edc92.exe
Size

164KB
MD5

0880df1564df30dd52384937a6637f90
SHA1

3820101d2cc88fea971646bb217da37e54d1fa15
SHA256

7e4f079821c66e7ff07526d6420db7fa4df2f810536774a3f5b67101e05edc92
SHA512

307eb1624555cb0d990023ec63fdaad7fc04a0d6a20bd3bdf1a60c6a5a178114983f10ea59d8e147f44e5d74812e62995c7359f2473baeac8987bb10865c4202
SSDEEP

3072:+VyouVB951AHxme/Qf1KSTSjY3A5genCgLNy+JYI6Vt+NwHnu:FnCHxme/Qf1KSTQgeCgLNyo36Vtciu

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1644 set thread context of 1960	1644	7e4f079821c66e7ff07526d6420db7fa4df2f810536774a3f5b67101e05edc92.exe	28

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1960	1644	7e4f079821c66e7ff07526d6420db7fa4df2f810536774a3f5b67101e05edc92.exe	28
PID 1644 wrote to memory of 1960	1644	7e4f079821c66e7ff07526d6420db7fa4df2f810536774a3f5b67101e05edc92.exe	28
PID 1644 wrote to memory of 1960	1644	7e4f079821c66e7ff07526d6420db7fa4df2f810536774a3f5b67101e05edc92.exe	28
PID 1644 wrote to memory of 1960	1644	7e4f079821c66e7ff07526d6420db7fa4df2f810536774a3f5b67101e05edc92.exe	28
PID 1644 wrote to memory of 1960	1644	7e4f079821c66e7ff07526d6420db7fa4df2f810536774a3f5b67101e05edc92.exe	28
PID 1644 wrote to memory of 1960	1644	7e4f079821c66e7ff07526d6420db7fa4df2f810536774a3f5b67101e05edc92.exe	28
PID 1644 wrote to memory of 1960	1644	7e4f079821c66e7ff07526d6420db7fa4df2f810536774a3f5b67101e05edc92.exe	28
PID 1644 wrote to memory of 1960	1644	7e4f079821c66e7ff07526d6420db7fa4df2f810536774a3f5b67101e05edc92.exe	28
PID 1644 wrote to memory of 1960	1644	7e4f079821c66e7ff07526d6420db7fa4df2f810536774a3f5b67101e05edc92.exe	28
PID 1644 wrote to memory of 1960	1644	7e4f079821c66e7ff07526d6420db7fa4df2f810536774a3f5b67101e05edc92.exe	28
PID 1960 wrote to memory of 1772	1960	7e4f079821c66e7ff07526d6420db7fa4df2f810536774a3f5b67101e05edc92.exe	29
PID 1960 wrote to memory of 1772	1960	7e4f079821c66e7ff07526d6420db7fa4df2f810536774a3f5b67101e05edc92.exe	29
PID 1960 wrote to memory of 1772	1960	7e4f079821c66e7ff07526d6420db7fa4df2f810536774a3f5b67101e05edc92.exe	29
PID 1960 wrote to memory of 1772	1960	7e4f079821c66e7ff07526d6420db7fa4df2f810536774a3f5b67101e05edc92.exe	29
PID 1960 wrote to memory of 1772	1960	7e4f079821c66e7ff07526d6420db7fa4df2f810536774a3f5b67101e05edc92.exe	29
PID 1960 wrote to memory of 1772	1960	7e4f079821c66e7ff07526d6420db7fa4df2f810536774a3f5b67101e05edc92.exe	29
PID 1960 wrote to memory of 1772	1960	7e4f079821c66e7ff07526d6420db7fa4df2f810536774a3f5b67101e05edc92.exe	29

C:\Users\Admin\AppData\Local\Temp\7e4f079821c66e7ff07526d6420db7fa4df2f810536774a3f5b67101e05edc92.exe
"C:\Users\Admin\AppData\Local\Temp\7e4f079821c66e7ff07526d6420db7fa4df2f810536774a3f5b67101e05edc92.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Users\Admin\AppData\Local\Temp\7e4f079821c66e7ff07526d6420db7fa4df2f810536774a3f5b67101e05edc92.exe
  C:\Users\Admin\AppData\Local\Temp\7e4f079821c66e7ff07526d6420db7fa4df2f810536774a3f5b67101e05edc92.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1644-54-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1644-59-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1772-60-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/1772-62-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/1772-63-0x0000000000000000-mapping.dmp

Download
memory/1772-65-0x0000000000790000-0x0000000000798000-memory.dmp

Filesize
32KB

Download
memory/1772-66-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/1960-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1960-56-0x0000000000401474-mapping.dmp

Download
memory/1960-58-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1960-64-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads