33f8fc18fe1072a4ef62150533914593802d9d82dc454e9642d941d5d2064efe

Analysis

max time kernel
40s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 14:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33f8fc18fe1072a4ef62150533914593802d9d82dc454e9642d941d5d2064efe.exe
Size

297KB
MD5

4c1e181d0da11fca52f22580a090ac1a
SHA1

cf37f825402d47f00f424c8dea6487ee85ae862e
SHA256

33f8fc18fe1072a4ef62150533914593802d9d82dc454e9642d941d5d2064efe
SHA512

8ff0db1cec43a8a190b6b4368e6dc4df7016ceeec742986d840db488a8e339b35434cc2a65834d3f85c7169d690f64a33bd217fb04b0699ba86ea7edfc075696
SSDEEP

6144:uNRCZcu8uF3TGCMwrtm9JYcsIhVr2KEo0gwSqgcWactvQYjxHLg+lIfJa1:+RC3E/j5xr2K4g/FnlYa

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

33f8fc18fe1072a4ef62150533914593802d9d82dc454e9642d941d5d2064efe.exe

description	pid	process	target process
PID 1652 set thread context of 1224	1652	33f8fc18fe1072a4ef62150533914593802d9d82dc454e9642d941d5d2064efe.exe	33f8fc18fe1072a4ef62150533914593802d9d82dc454e9642d941d5d2064efe.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

33f8fc18fe1072a4ef62150533914593802d9d82dc454e9642d941d5d2064efe.exe

description	pid	process	target process
PID 1652 wrote to memory of 1224	1652	33f8fc18fe1072a4ef62150533914593802d9d82dc454e9642d941d5d2064efe.exe	33f8fc18fe1072a4ef62150533914593802d9d82dc454e9642d941d5d2064efe.exe
PID 1652 wrote to memory of 1224	1652	33f8fc18fe1072a4ef62150533914593802d9d82dc454e9642d941d5d2064efe.exe	33f8fc18fe1072a4ef62150533914593802d9d82dc454e9642d941d5d2064efe.exe
PID 1652 wrote to memory of 1224	1652	33f8fc18fe1072a4ef62150533914593802d9d82dc454e9642d941d5d2064efe.exe	33f8fc18fe1072a4ef62150533914593802d9d82dc454e9642d941d5d2064efe.exe
PID 1652 wrote to memory of 1224	1652	33f8fc18fe1072a4ef62150533914593802d9d82dc454e9642d941d5d2064efe.exe	33f8fc18fe1072a4ef62150533914593802d9d82dc454e9642d941d5d2064efe.exe
PID 1652 wrote to memory of 1224	1652	33f8fc18fe1072a4ef62150533914593802d9d82dc454e9642d941d5d2064efe.exe	33f8fc18fe1072a4ef62150533914593802d9d82dc454e9642d941d5d2064efe.exe
PID 1652 wrote to memory of 1224	1652	33f8fc18fe1072a4ef62150533914593802d9d82dc454e9642d941d5d2064efe.exe	33f8fc18fe1072a4ef62150533914593802d9d82dc454e9642d941d5d2064efe.exe
PID 1652 wrote to memory of 1224	1652	33f8fc18fe1072a4ef62150533914593802d9d82dc454e9642d941d5d2064efe.exe	33f8fc18fe1072a4ef62150533914593802d9d82dc454e9642d941d5d2064efe.exe
PID 1652 wrote to memory of 1224	1652	33f8fc18fe1072a4ef62150533914593802d9d82dc454e9642d941d5d2064efe.exe	33f8fc18fe1072a4ef62150533914593802d9d82dc454e9642d941d5d2064efe.exe
PID 1652 wrote to memory of 1224	1652	33f8fc18fe1072a4ef62150533914593802d9d82dc454e9642d941d5d2064efe.exe	33f8fc18fe1072a4ef62150533914593802d9d82dc454e9642d941d5d2064efe.exe

C:\Users\Admin\AppData\Local\Temp\33f8fc18fe1072a4ef62150533914593802d9d82dc454e9642d941d5d2064efe.exe
"C:\Users\Admin\AppData\Local\Temp\33f8fc18fe1072a4ef62150533914593802d9d82dc454e9642d941d5d2064efe.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1652

C:\Users\Admin\AppData\Local\Temp\33f8fc18fe1072a4ef62150533914593802d9d82dc454e9642d941d5d2064efe.exe
"C:\Users\Admin\AppData\Local\Temp\33f8fc18fe1072a4ef62150533914593802d9d82dc454e9642d941d5d2064efe.exe"
2⤵
PID:1224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1224-55-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1224-56-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1224-58-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1224-59-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1224-61-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1224-62-0x000000000041758F-mapping.dmp

Download
memory/1224-65-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/1224-66-0x0000000000CA0000-0x0000000000CEE000-memory.dmp

Filesize
312KB

Download
memory/1224-67-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1224-68-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1652-54-0x0000000000CA0000-0x0000000000CEE000-memory.dmp

Filesize
312KB

Download
memory/1652-64-0x0000000000CA0000-0x0000000000CEE000-memory.dmp

Filesize
312KB

Download