7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b

Analysis

max time kernel
184s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe
Size

1.3MB
MD5

b638f155554f0f92cad1b13c568a0826
SHA1

dea71b37cf2bfba7a7b3b052f87e83ea9470a89f
SHA256

7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b
SHA512

35d442c3a0ba9e5abe613c242354466f8332e4b41d0e12895e6a431076c21f0620eaa36e530f5d2e2a851df3dd436895a21d782a3b1c9639cf5324890200bc37
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakQ:7rKo4ZwCOnYjVmJPa/

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe

description	pid	process	target process
PID 1964 set thread context of 4900	1964	7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe	7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe

pid	process
4900	7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe
4900	7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe
4900	7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe
4900	7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe
4900	7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe

description	pid	process	target process
PID 1964 wrote to memory of 4900	1964	7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe	7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe
PID 1964 wrote to memory of 4900	1964	7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe	7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe
PID 1964 wrote to memory of 4900	1964	7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe	7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe
PID 1964 wrote to memory of 4900	1964	7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe	7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe
PID 1964 wrote to memory of 4900	1964	7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe	7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe
PID 1964 wrote to memory of 4900	1964	7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe	7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe
PID 1964 wrote to memory of 4900	1964	7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe	7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe
PID 1964 wrote to memory of 4900	1964	7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe	7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe
PID 1964 wrote to memory of 4900	1964	7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe	7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe
PID 1964 wrote to memory of 4900	1964	7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe	7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe

C:\Users\Admin\AppData\Local\Temp\7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe
"C:\Users\Admin\AppData\Local\Temp\7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1964

C:\Users\Admin\AppData\Local\Temp\7f5511f65cc6287b32dfa84e19012a486d0d3c267f34fb9cb71d9678ec48e91b.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4900-132-0x0000000000000000-mapping.dmp

Download
memory/4900-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4900-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4900-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4900-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4900-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download