9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10

Analysis

max time kernel
187s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe
Size

1.3MB
MD5

057683bdb71eee595b69a0e9134e275d
SHA1

c25b0f3ad88e4e42ef884f7643d68c1f03cced0e
SHA256

9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10
SHA512

5d104ecc91a84bdffd2c98a07c88a0ded6b88e2f02804687e0e10b5878415f750fd4af3c2f46d85c90a2848eefa4954d4320c0a5b09c9043a5cc3cccd93afa81
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak:7rKo4ZwCOnYjVmJPa

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe

description	pid	process	target process
PID 1116 set thread context of 344	1116	9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe	9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe

pid	process
344	9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe
344	9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe
344	9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe
344	9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe
344	9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe

description	pid	process	target process
PID 1116 wrote to memory of 344	1116	9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe	9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe
PID 1116 wrote to memory of 344	1116	9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe	9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe
PID 1116 wrote to memory of 344	1116	9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe	9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe
PID 1116 wrote to memory of 344	1116	9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe	9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe
PID 1116 wrote to memory of 344	1116	9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe	9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe
PID 1116 wrote to memory of 344	1116	9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe	9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe
PID 1116 wrote to memory of 344	1116	9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe	9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe
PID 1116 wrote to memory of 344	1116	9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe	9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe
PID 1116 wrote to memory of 344	1116	9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe	9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe
PID 1116 wrote to memory of 344	1116	9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe	9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe

C:\Users\Admin\AppData\Local\Temp\9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe
"C:\Users\Admin\AppData\Local\Temp\9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1116

C:\Users\Admin\AppData\Local\Temp\9c7d2791ef585e3b2787699d99c455ed11f537a7a8230b8305a8a37188e5ad10.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/344-132-0x0000000000000000-mapping.dmp

Download
memory/344-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/344-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/344-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/344-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/344-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/344-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download