eb87b0b6b27dcbd3962af5dc0e5a8f027e291bd58870d3f82ed69c32117f8a50

Analysis

max time kernel
7s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb87b0b6b27dcbd3962af5dc0e5a8f027e291bd58870d3f82ed69c32117f8a50.exe
Size

233KB
MD5

05940fa27f8ce67c398ac47a48955f5f
SHA1

31269bbcd314a02b0d4f91886a944a2d76490836
SHA256

eb87b0b6b27dcbd3962af5dc0e5a8f027e291bd58870d3f82ed69c32117f8a50
SHA512

a86e44c4e7073a53ae2a683720cf3ac9e778f0d326098c487b0ca38ab3cc49249027b12d8e4f250e51c30440ea4901ae65475fe84075cca9560b15589fa0783b
SSDEEP

6144:LbWjUgmaaSlI/1SZfGmeQazRLHSr7IP4Q8Hm:/Wog5aSlk1YGm9ELHSkjJ

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

eb87b0b6b27dcbd3962af5dc0e5a8f027e291bd58870d3f82ed69c32117f8a50.exe

description	pid	process	target process
PID 1888 set thread context of 940	1888	eb87b0b6b27dcbd3962af5dc0e5a8f027e291bd58870d3f82ed69c32117f8a50.exe	eb87b0b6b27dcbd3962af5dc0e5a8f027e291bd58870d3f82ed69c32117f8a50.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

eb87b0b6b27dcbd3962af5dc0e5a8f027e291bd58870d3f82ed69c32117f8a50.exe

description	pid	process	target process
PID 1888 wrote to memory of 940	1888	eb87b0b6b27dcbd3962af5dc0e5a8f027e291bd58870d3f82ed69c32117f8a50.exe	eb87b0b6b27dcbd3962af5dc0e5a8f027e291bd58870d3f82ed69c32117f8a50.exe
PID 1888 wrote to memory of 940	1888	eb87b0b6b27dcbd3962af5dc0e5a8f027e291bd58870d3f82ed69c32117f8a50.exe	eb87b0b6b27dcbd3962af5dc0e5a8f027e291bd58870d3f82ed69c32117f8a50.exe
PID 1888 wrote to memory of 940	1888	eb87b0b6b27dcbd3962af5dc0e5a8f027e291bd58870d3f82ed69c32117f8a50.exe	eb87b0b6b27dcbd3962af5dc0e5a8f027e291bd58870d3f82ed69c32117f8a50.exe
PID 1888 wrote to memory of 940	1888	eb87b0b6b27dcbd3962af5dc0e5a8f027e291bd58870d3f82ed69c32117f8a50.exe	eb87b0b6b27dcbd3962af5dc0e5a8f027e291bd58870d3f82ed69c32117f8a50.exe
PID 1888 wrote to memory of 940	1888	eb87b0b6b27dcbd3962af5dc0e5a8f027e291bd58870d3f82ed69c32117f8a50.exe	eb87b0b6b27dcbd3962af5dc0e5a8f027e291bd58870d3f82ed69c32117f8a50.exe
PID 1888 wrote to memory of 940	1888	eb87b0b6b27dcbd3962af5dc0e5a8f027e291bd58870d3f82ed69c32117f8a50.exe	eb87b0b6b27dcbd3962af5dc0e5a8f027e291bd58870d3f82ed69c32117f8a50.exe
PID 1888 wrote to memory of 940	1888	eb87b0b6b27dcbd3962af5dc0e5a8f027e291bd58870d3f82ed69c32117f8a50.exe	eb87b0b6b27dcbd3962af5dc0e5a8f027e291bd58870d3f82ed69c32117f8a50.exe
PID 1888 wrote to memory of 940	1888	eb87b0b6b27dcbd3962af5dc0e5a8f027e291bd58870d3f82ed69c32117f8a50.exe	eb87b0b6b27dcbd3962af5dc0e5a8f027e291bd58870d3f82ed69c32117f8a50.exe
PID 1888 wrote to memory of 940	1888	eb87b0b6b27dcbd3962af5dc0e5a8f027e291bd58870d3f82ed69c32117f8a50.exe	eb87b0b6b27dcbd3962af5dc0e5a8f027e291bd58870d3f82ed69c32117f8a50.exe

C:\Users\Admin\AppData\Local\Temp\eb87b0b6b27dcbd3962af5dc0e5a8f027e291bd58870d3f82ed69c32117f8a50.exe
"C:\Users\Admin\AppData\Local\Temp\eb87b0b6b27dcbd3962af5dc0e5a8f027e291bd58870d3f82ed69c32117f8a50.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1888

\??\c:\users\admin\appdata\local\temp\eb87b0b6b27dcbd3962af5dc0e5a8f027e291bd58870d3f82ed69c32117f8a50.exe
"c:\users\admin\appdata\local\temp\eb87b0b6b27dcbd3962af5dc0e5a8f027e291bd58870d3f82ed69c32117f8a50.exe"
2⤵
PID:940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/940-54-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/940-55-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/940-57-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/940-58-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/940-60-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/940-61-0x0000000000431055-mapping.dmp

Download
memory/940-63-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/940-64-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download