a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0

Analysis

max time kernel
168s
max time network
198s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe
Size

114KB
MD5

e2e6674fc6ae6302ce8959b6686e1271
SHA1

d414eaa34b5c2956b5ff7a397a18413dd6570a9e
SHA256

a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0
SHA512

d912c971df40caf8994b9c298c872b3b6cfb01f34b18e9b2205ee6e38a8176f0a22e2a4e7a12675fa04a53ae21b2523498a9d3eab748d9d8882ad53edaa03850
SSDEEP

3072:MkvGoWRDcYIBs8QrkOWCXwY7vKHL8QOPnI+iH2uapAnD:zeoWbIBsrrQ87A8zhbAD

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe

description	pid	process	target process
PID 852 set thread context of 1872	852	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe

description	pid	process	target process
PID 852 wrote to memory of 1872	852	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe
PID 852 wrote to memory of 1872	852	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe
PID 852 wrote to memory of 1872	852	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe
PID 852 wrote to memory of 1872	852	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe
PID 852 wrote to memory of 1872	852	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe
PID 852 wrote to memory of 1872	852	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe
PID 852 wrote to memory of 1872	852	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe
PID 852 wrote to memory of 1872	852	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe
PID 852 wrote to memory of 1872	852	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe
PID 852 wrote to memory of 1872	852	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe	a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe

C:\Users\Admin\AppData\Local\Temp\a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe
"C:\Users\Admin\AppData\Local\Temp\a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:852

C:\Users\Admin\AppData\Local\Temp\a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe
"C:\Users\Admin\AppData\Local\Temp\a74765a6eeecb317ed81dfa6da107c712b320a3939cc52524efa1a9c55c359b0.exe"
2⤵
PID:1872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/852-54-0x0000000076941000-0x0000000076943000-memory.dmp

Filesize
8KB

Download
memory/852-55-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/852-57-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1872-56-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1872-60-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1872-61-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1872-62-0x0000000072D41000-0x0000000072D43000-memory.dmp

Filesize
8KB

Download