f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba

Analysis

max time kernel
149s
max time network
166s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe
Size

80KB
MD5

83b5c4c91e61728fa83fcf93451cfe23
SHA1

e667504dfe1a454d7d994134bcb947d48006c71f
SHA256

f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba
SHA512

be70d445b24be2552f0be7001d6aa570cb8179a8408fa231988a30c600ec5e425406eb937e8bea6b27cca0566f1934a1e0fcad589bfc821a30891ec52c981347
SSDEEP

1536:ua02w4XHHHDEC70WrP1lhmDdimz/RMhkv6U:u4DHHeWrPThGP2kvB

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe

description	pid	process	target process
PID 2040 set thread context of 1204	2040	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe

pid	process
2040	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe
2040	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe

description	pid	process	target process
PID 2040 wrote to memory of 1204	2040	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe
PID 2040 wrote to memory of 1204	2040	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe
PID 2040 wrote to memory of 1204	2040	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe
PID 2040 wrote to memory of 1204	2040	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe
PID 2040 wrote to memory of 1204	2040	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe
PID 2040 wrote to memory of 1204	2040	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe
PID 2040 wrote to memory of 1204	2040	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe
PID 2040 wrote to memory of 1204	2040	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe
PID 2040 wrote to memory of 1204	2040	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe

C:\Users\Admin\AppData\Local\Temp\f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe
"C:\Users\Admin\AppData\Local\Temp\f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040

C:\Users\Admin\AppData\Local\Temp\f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe
C:\Users\Admin\AppData\Local\Temp\f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe
2⤵
PID:1204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1204-55-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1204-56-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1204-58-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1204-59-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1204-61-0x000000000040569F-mapping.dmp

Download
memory/1204-60-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1204-65-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2040-54-0x0000000075991000-0x0000000075993000-memory.dmp

Filesize
8KB

Download
memory/2040-62-0x00000000002B0000-0x00000000002B4000-memory.dmp

Filesize
16KB

Download