7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe
Size

1.3MB
MD5

2148632f94e0a57604b6bebbc33d5374
SHA1

4ab501eb3e2634039ad04323aa41bb056a7035b0
SHA256

7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680
SHA512

00e24b19db6b8ec8d6974632b2daae36c426bc6509767729d440f64b406ab97ca002aa5bbbd90a67d7602d0fb4263b33b1297b8daac2ba3cd3f3641b3742ef3a
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakg:7rKo4ZwCOnYjVmJPa3

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe

description	pid	process	target process
PID 3188 set thread context of 3544	3188	7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe	7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe

pid	process
3544	7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe
3544	7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe
3544	7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe
3544	7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe
3544	7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe

description	pid	process	target process
PID 3188 wrote to memory of 3544	3188	7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe	7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe
PID 3188 wrote to memory of 3544	3188	7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe	7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe
PID 3188 wrote to memory of 3544	3188	7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe	7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe
PID 3188 wrote to memory of 3544	3188	7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe	7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe
PID 3188 wrote to memory of 3544	3188	7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe	7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe
PID 3188 wrote to memory of 3544	3188	7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe	7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe
PID 3188 wrote to memory of 3544	3188	7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe	7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe
PID 3188 wrote to memory of 3544	3188	7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe	7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe
PID 3188 wrote to memory of 3544	3188	7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe	7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe
PID 3188 wrote to memory of 3544	3188	7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe	7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe

C:\Users\Admin\AppData\Local\Temp\7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe
"C:\Users\Admin\AppData\Local\Temp\7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3188

C:\Users\Admin\AppData\Local\Temp\7eb02fc931f581d3a1b96b9569f6ebd472a8608df227c57915b4e73773f90680.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:3544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3544-132-0x0000000000000000-mapping.dmp

Download
memory/3544-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3544-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3544-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3544-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3544-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download