07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb

Analysis

max time kernel
139s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 06:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe
Size

1.4MB
MD5

e190719a3cf3b0bad47792eba8f2b36b
SHA1

be5e0a4820de1029333237cb174fb5989ef4bef2
SHA256

07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb
SHA512

5ab0338bac336db77d3b34b89ae2bb85b8eba34ce52bdb59097013b1a66d5d910cf0dce4377400c759366f6c070bbdaeff391baf9a02c892172892c3240829ea
SSDEEP

24576:BrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8Ai:BrBew72604doSw6ew9

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe

description	pid	process	target process
PID 2120 set thread context of 952	2120	07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe	07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe

pid	process
952	07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe
952	07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe
952	07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe
952	07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe
952	07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe

description	pid	process	target process
PID 2120 wrote to memory of 952	2120	07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe	07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe
PID 2120 wrote to memory of 952	2120	07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe	07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe
PID 2120 wrote to memory of 952	2120	07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe	07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe
PID 2120 wrote to memory of 952	2120	07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe	07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe
PID 2120 wrote to memory of 952	2120	07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe	07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe
PID 2120 wrote to memory of 952	2120	07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe	07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe
PID 2120 wrote to memory of 952	2120	07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe	07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe
PID 2120 wrote to memory of 952	2120	07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe	07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe
PID 2120 wrote to memory of 952	2120	07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe	07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe
PID 2120 wrote to memory of 952	2120	07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe	07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe

C:\Users\Admin\AppData\Local\Temp\07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe
"C:\Users\Admin\AppData\Local\Temp\07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Users\Admin\AppData\Local\Temp\07ef4ed7b3142f142633ec6f949839730aff1a86afe37e2e89da6cbd80f3fceb.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/952-132-0x0000000000000000-mapping.dmp

Download
memory/952-133-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/952-134-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/952-135-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/952-136-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/952-137-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download