Analysis
-
max time kernel
42s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 17:59
Behavioral task
behavioral1
Sample
aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe
Resource
win7-20220901-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe
-
Size
227KB
-
MD5
0d9b57ad69d8f9364df23509f7f40803
-
SHA1
36ee6dcc16f33b2e729e8f7d17d769de6f14da2e
-
SHA256
aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f
-
SHA512
dc552420c82ddb53274a955930b8f222b4fbc453a1494044639d88a9f28ad9f206d0bd253b51902c420ab6e1ad75d31354d7508334633cea7e9b776c787cda4a
-
SSDEEP
3072:Mft17Shr0JWA4oef8HPNzlnW9Sl0jzmVXLtiFmTv1WvwvX+q2jrRyvcnNPKu3RY6:Mz7wr0IrwAzmVNYNJCa6As6+0
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2044-56-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/2044-59-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/2044-60-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/2044-70-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/2028-79-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of SetThreadContext 9 IoCs
description pid Process procid_target PID 2028 set thread context of 2044 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe 26 PID 2028 set thread context of 0 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2044 set thread context of 2012 2044 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe 27 PID 2028 set thread context of 0 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2028 set thread context of 0 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2012 set thread context of 656 2012 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe 28 PID 2012 set thread context of 0 2012 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2028 set thread context of 0 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2028 set thread context of 0 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe 2044 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe 2012 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe -
Suspicious use of WriteProcessMemory 55 IoCs
description pid Process procid_target PID 2028 wrote to memory of 2044 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe 26 PID 2028 wrote to memory of 2044 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe 26 PID 2028 wrote to memory of 2044 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe 26 PID 2028 wrote to memory of 2044 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe 26 PID 2028 wrote to memory of 2044 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe 26 PID 2028 wrote to memory of 2044 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe 26 PID 2028 wrote to memory of 2044 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe 26 PID 2028 wrote to memory of 2044 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe 26 PID 2028 wrote to memory of 2044 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe 26 PID 2028 wrote to memory of 0 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2028 wrote to memory of 0 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2028 wrote to memory of 0 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2028 wrote to memory of 0 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2028 wrote to memory of 0 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2028 wrote to memory of 0 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2028 wrote to memory of 0 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2044 wrote to memory of 2012 2044 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe 27 PID 2044 wrote to memory of 2012 2044 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe 27 PID 2044 wrote to memory of 2012 2044 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe 27 PID 2044 wrote to memory of 2012 2044 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe 27 PID 2044 wrote to memory of 2012 2044 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe 27 PID 2044 wrote to memory of 2012 2044 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe 27 PID 2044 wrote to memory of 2012 2044 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe 27 PID 2044 wrote to memory of 2012 2044 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe 27 PID 2044 wrote to memory of 2012 2044 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe 27 PID 2028 wrote to memory of 0 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2028 wrote to memory of 0 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2028 wrote to memory of 0 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2028 wrote to memory of 0 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2028 wrote to memory of 0 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2028 wrote to memory of 0 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2028 wrote to memory of 0 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2028 wrote to memory of 0 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2012 wrote to memory of 656 2012 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe 28 PID 2012 wrote to memory of 656 2012 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe 28 PID 2012 wrote to memory of 656 2012 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe 28 PID 2012 wrote to memory of 656 2012 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe 28 PID 2012 wrote to memory of 656 2012 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe 28 PID 2012 wrote to memory of 656 2012 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe 28 PID 2012 wrote to memory of 656 2012 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe 28 PID 2012 wrote to memory of 656 2012 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe 28 PID 2028 wrote to memory of 0 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2028 wrote to memory of 0 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2012 wrote to memory of 0 2012 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2012 wrote to memory of 0 2012 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2012 wrote to memory of 0 2012 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2012 wrote to memory of 0 2012 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2028 wrote to memory of 0 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2028 wrote to memory of 0 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2028 wrote to memory of 0 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2028 wrote to memory of 0 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2028 wrote to memory of 0 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2028 wrote to memory of 0 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2028 wrote to memory of 0 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe PID 2028 wrote to memory of 0 2028 aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe"C:\Users\Admin\AppData\Local\Temp\aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe"C:\Users\Admin\AppData\Local\Temp\aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe"C:\Users\Admin\AppData\Local\Temp\aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe"C:\Users\Admin\AppData\Local\Temp\aa3104da7855119d6f6fe9db2a3496621756c232d13e875b049650a3de106d7f.exe"4⤵PID:656
-
-
-