a67575d1a4b6188e5c1b33fbf4785945f56a9972045530ed2ed44900fa5bd598

Analysis

max time kernel
37s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 16:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a67575d1a4b6188e5c1b33fbf4785945f56a9972045530ed2ed44900fa5bd598.exe
Size

404KB
MD5

0996c64b1c3062b3b9c26e6ae8c7ac98
SHA1

49a306740752233fe98c55916f1cee2736371b62
SHA256

a67575d1a4b6188e5c1b33fbf4785945f56a9972045530ed2ed44900fa5bd598
SHA512

2b33c0b4f2ceded5b346d0c71be7e419963d1b6a150f6347984d9b4c4c209fa8e4a51cefa89ecb5065106c249a614bd6aa3ca905b93b3497b5daa92c94df2b3f
SSDEEP

6144:nz/SHDeFt3aNCL32OoJDGsnA33d4fd3mSqV/aN:zXhGLOoJDOSKg

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1708 set thread context of 1996	1708	a67575d1a4b6188e5c1b33fbf4785945f56a9972045530ed2ed44900fa5bd598.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1996	a67575d1a4b6188e5c1b33fbf4785945f56a9972045530ed2ed44900fa5bd598.eXe
1996	a67575d1a4b6188e5c1b33fbf4785945f56a9972045530ed2ed44900fa5bd598.eXe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1708	a67575d1a4b6188e5c1b33fbf4785945f56a9972045530ed2ed44900fa5bd598.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1996	1708	a67575d1a4b6188e5c1b33fbf4785945f56a9972045530ed2ed44900fa5bd598.exe	27
PID 1708 wrote to memory of 1996	1708	a67575d1a4b6188e5c1b33fbf4785945f56a9972045530ed2ed44900fa5bd598.exe	27
PID 1708 wrote to memory of 1996	1708	a67575d1a4b6188e5c1b33fbf4785945f56a9972045530ed2ed44900fa5bd598.exe	27
PID 1708 wrote to memory of 1996	1708	a67575d1a4b6188e5c1b33fbf4785945f56a9972045530ed2ed44900fa5bd598.exe	27
PID 1708 wrote to memory of 1996	1708	a67575d1a4b6188e5c1b33fbf4785945f56a9972045530ed2ed44900fa5bd598.exe	27
PID 1708 wrote to memory of 1996	1708	a67575d1a4b6188e5c1b33fbf4785945f56a9972045530ed2ed44900fa5bd598.exe	27
PID 1708 wrote to memory of 1996	1708	a67575d1a4b6188e5c1b33fbf4785945f56a9972045530ed2ed44900fa5bd598.exe	27
PID 1708 wrote to memory of 1996	1708	a67575d1a4b6188e5c1b33fbf4785945f56a9972045530ed2ed44900fa5bd598.exe	27
PID 1996 wrote to memory of 1420	1996	a67575d1a4b6188e5c1b33fbf4785945f56a9972045530ed2ed44900fa5bd598.eXe	16
PID 1996 wrote to memory of 1420	1996	a67575d1a4b6188e5c1b33fbf4785945f56a9972045530ed2ed44900fa5bd598.eXe	16
PID 1996 wrote to memory of 1420	1996	a67575d1a4b6188e5c1b33fbf4785945f56a9972045530ed2ed44900fa5bd598.eXe	16
PID 1996 wrote to memory of 1420	1996	a67575d1a4b6188e5c1b33fbf4785945f56a9972045530ed2ed44900fa5bd598.eXe	16
PID 1996 wrote to memory of 1420	1996	a67575d1a4b6188e5c1b33fbf4785945f56a9972045530ed2ed44900fa5bd598.eXe	16
PID 1996 wrote to memory of 1420	1996	a67575d1a4b6188e5c1b33fbf4785945f56a9972045530ed2ed44900fa5bd598.eXe	16

C:\Users\Admin\AppData\Local\Temp\a67575d1a4b6188e5c1b33fbf4785945f56a9972045530ed2ed44900fa5bd598.exe
"C:\Users\Admin\AppData\Local\Temp\a67575d1a4b6188e5c1b33fbf4785945f56a9972045530ed2ed44900fa5bd598.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Users\Admin\AppData\Local\Temp\a67575d1a4b6188e5c1b33fbf4785945f56a9972045530ed2ed44900fa5bd598.eXe
  "C:\Users\Admin\AppData\Local\Temp/a67575d1a4b6188e5c1b33fbf4785945f56a9972045530ed2ed44900fa5bd598.eXe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1996

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1420-67-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

Filesize
24KB

Download
memory/1708-56-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/1996-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1996-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1996-60-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1996-61-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1996-65-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1996-66-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download