7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a

Analysis

max time kernel
157s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 06:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe
Size

1.1MB
MD5

d70feab0c15d02951c194a923d88186e
SHA1

91f675563203af7b3211b14d669d68490bfc838d
SHA256

7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a
SHA512

848879742d8938ab7faef8bbbe8beb47e3dba6aeb0c6fe128c8a72e14a72a6dc0225d0b5cd0020b6d935b31c1711a5e16c0f9e01e7d45b3512a9e58e39633712
SSDEEP

24576:FiEpT/UOYXYGifoZHO6m6WSq06cDypII5dD:B5j3IZuU60nCIIv

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe

description	pid	process	target process
PID 4344 set thread context of 2568	4344	7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe	7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe

pid	process
2568	7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe
2568	7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe
2568	7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe
2568	7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe
2568	7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe

description	pid	process	target process
PID 4344 wrote to memory of 2568	4344	7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe	7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe
PID 4344 wrote to memory of 2568	4344	7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe	7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe
PID 4344 wrote to memory of 2568	4344	7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe	7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe
PID 4344 wrote to memory of 2568	4344	7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe	7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe
PID 4344 wrote to memory of 2568	4344	7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe	7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe
PID 4344 wrote to memory of 2568	4344	7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe	7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe
PID 4344 wrote to memory of 2568	4344	7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe	7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe
PID 4344 wrote to memory of 2568	4344	7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe	7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe
PID 4344 wrote to memory of 2568	4344	7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe	7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe
PID 4344 wrote to memory of 2568	4344	7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe	7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe

C:\Users\Admin\AppData\Local\Temp\7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe
"C:\Users\Admin\AppData\Local\Temp\7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4344

C:\Users\Admin\AppData\Local\Temp\7ea1a33e2b8c3af21934729803a6f89ddaa32d866dd3c467e3435c5e9dfc1a9a.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:2568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2568-132-0x0000000000000000-mapping.dmp

Download
memory/2568-133-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2568-134-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2568-135-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2568-136-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2568-137-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download