7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00

Analysis

max time kernel
253s
max time network
323s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe
Size

1.5MB
MD5

9f80e9e4e750bc5c51d3e55bc439ac93
SHA1

f2268fd21f9a400679b9757b063db8e35fb14c29
SHA256

7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00
SHA512

2328e34d1abebccef0055821fa147b11fcd03b34663025c4fb51911162d49897789559c5e74f06c0fbff7f7ff88c6fc09579fb60b57311aaf1eb8cd08a03ac01
SSDEEP

24576:VzD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUY1:v6/ye0PIphrp9Zuvjqa0Uidi

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe

description	pid	process	target process
PID 3116 set thread context of 1816	3116	7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe	7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe

pid	process
1816	7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe
1816	7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe
1816	7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe
1816	7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe
1816	7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe

description	pid	process	target process
PID 3116 wrote to memory of 1816	3116	7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe	7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe
PID 3116 wrote to memory of 1816	3116	7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe	7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe
PID 3116 wrote to memory of 1816	3116	7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe	7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe
PID 3116 wrote to memory of 1816	3116	7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe	7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe
PID 3116 wrote to memory of 1816	3116	7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe	7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe
PID 3116 wrote to memory of 1816	3116	7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe	7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe
PID 3116 wrote to memory of 1816	3116	7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe	7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe
PID 3116 wrote to memory of 1816	3116	7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe	7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe
PID 3116 wrote to memory of 1816	3116	7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe	7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe
PID 3116 wrote to memory of 1816	3116	7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe	7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe

C:\Users\Admin\AppData\Local\Temp\7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe
"C:\Users\Admin\AppData\Local\Temp\7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3116

C:\Users\Admin\AppData\Local\Temp\7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe
"C:\Users\Admin\AppData\Local\Temp\7322a3440b8ae7a8196beb9510974686d7d27b67a867c493efed279b9dbb3a00.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1816-132-0x0000000000000000-mapping.dmp

Download
memory/1816-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1816-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1816-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1816-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download