7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1

Analysis

max time kernel
161s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe
Size

1.3MB
MD5

409feedf34ec276a991f1e8d9b6d4cc1
SHA1

0b009b5336aba5ae674cbe3657a90664af3e4564
SHA256

7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1
SHA512

9221b094c10ba5ccee22f10c891ad166e10187fb7f84c4c776bbb8267cb57da31c9640a5ebc302a10009e787cfeecff1d09436815709757673d3e2ffdb062aa1
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakz:zrKo4ZwCOnYjVmJPa0

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe

description	pid	process	target process
PID 5016 set thread context of 4764	5016	7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe	7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe

pid	process
4764	7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe
4764	7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe
4764	7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe
4764	7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe
4764	7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe

description	pid	process	target process
PID 5016 wrote to memory of 4764	5016	7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe	7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe
PID 5016 wrote to memory of 4764	5016	7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe	7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe
PID 5016 wrote to memory of 4764	5016	7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe	7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe
PID 5016 wrote to memory of 4764	5016	7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe	7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe
PID 5016 wrote to memory of 4764	5016	7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe	7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe
PID 5016 wrote to memory of 4764	5016	7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe	7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe
PID 5016 wrote to memory of 4764	5016	7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe	7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe
PID 5016 wrote to memory of 4764	5016	7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe	7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe
PID 5016 wrote to memory of 4764	5016	7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe	7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe
PID 5016 wrote to memory of 4764	5016	7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe	7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe

C:\Users\Admin\AppData\Local\Temp\7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe
"C:\Users\Admin\AppData\Local\Temp\7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5016

C:\Users\Admin\AppData\Local\Temp\7ed2b99e490f522a406810bef343277d6b60838c4e5de5d8d82e178d1c323ef1.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4764-132-0x0000000000000000-mapping.dmp

Download
memory/4764-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4764-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4764-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4764-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4764-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download