8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d

Analysis

max time kernel
236s
max time network
333s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe
Size

249KB
MD5

3be7196a04429db531a99f71ab29837c
SHA1

d0e4817a447d696ab685f283329e6be87680db77
SHA256

8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d
SHA512

ee8c2eceee60c8fd210ed80f5b6a94c83c98ee781ba7a43e1b11bb7b8d0d2c46fbc1ddec65467129b42ff1acf028354a780c1e599684265259ac2bece9a38867
SSDEEP

6144:WnrxN0zGWR1h1UBgmAzxsLKFSZi1MRX2reeXTHmX:WnV2zGWvh1UBgrV4KSEMRGrrzm

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe

description	pid	process	target process
PID 1112 set thread context of 1924	1112	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe

description	pid	process	target process
PID 1112 wrote to memory of 1924	1112	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe
PID 1112 wrote to memory of 1924	1112	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe
PID 1112 wrote to memory of 1924	1112	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe
PID 1112 wrote to memory of 1924	1112	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe
PID 1112 wrote to memory of 1924	1112	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe
PID 1112 wrote to memory of 1924	1112	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe
PID 1112 wrote to memory of 1924	1112	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe
PID 1112 wrote to memory of 1924	1112	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe
PID 1112 wrote to memory of 1924	1112	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe

C:\Users\Admin\AppData\Local\Temp\8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe
"C:\Users\Admin\AppData\Local\Temp\8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1112

\??\c:\users\admin\appdata\local\temp\8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe
"c:\users\admin\appdata\local\temp\8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe"
2⤵
PID:1924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1924-54-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1924-55-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1924-57-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1924-61-0x0000000000434055-mapping.dmp

Download
memory/1924-60-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1924-58-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1924-63-0x0000000076771000-0x0000000076773000-memory.dmp

Filesize
8KB

Download
memory/1924-64-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download