Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07-11-2022 09:40
Static task
static1
Behavioral task
behavioral1
Sample
ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe
-
Size
66KB
-
MD5
0fccb96da5649a2af218c08397a7406c
-
SHA1
6ae85d924d39c9b9fa750a5526a16c858a7f5b4a
-
SHA256
ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717
-
SHA512
0e2230ecf7c36b19e224a1e8942c0de36e12e7f202d09bbfac5095ddfc14b76789adfb549752f49368a61fe5771bdcff0079b762904bfcbaf8f5c750cd1e864f
-
SSDEEP
1536:S+zHcTalTzHz/lBx6NxgH8cVkaRHp9dMadhbQn:rznhzHz/lBs2H8OkaxdZdFi
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1048 set thread context of 540 1048 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 27 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1048 wrote to memory of 540 1048 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 27 PID 1048 wrote to memory of 540 1048 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 27 PID 1048 wrote to memory of 540 1048 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 27 PID 1048 wrote to memory of 540 1048 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 27 PID 1048 wrote to memory of 540 1048 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 27 PID 1048 wrote to memory of 540 1048 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 27 PID 1048 wrote to memory of 540 1048 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 27 PID 1048 wrote to memory of 540 1048 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 27 PID 1048 wrote to memory of 540 1048 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 27 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10 PID 540 wrote to memory of 1216 540 ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe 10
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe"C:\Users\Admin\AppData\Local\Temp\ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\ebaa85c43bf811a768688d6063bac7a58d47c4481a8c06915f72cf3c96f2f717.exe䌢尺獕牥屳摁業屮灁䑰瑡屡潌慣屬敔灭敜慢㡡挵㌴晢ㄸ愱㘷㘸㠸㙤㘰戳捡愷㠵㑤挷㐴ㄸ㡡っ㤶㔱㝦挲㍦㥣昶昲ㄷ⸷硥≥3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:540
-
-