d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826

Analysis

max time kernel
43s
max time network
52s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 16:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe
Size

71KB
MD5

45e0988e730535833c371b3849ef83d0
SHA1

fc46692fb94ea10281d939e54219b066a0543cdb
SHA256

d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826
SHA512

d084319d40eef8ba41cb7d88c1aeb3f714c3248c9bc46d1befa5b7b63812e97184c86d3856455d82c0da8df1c7697eca618fcb830740acdba44bb332533eb8e7
SSDEEP

1536:awukRGOPPXpKLqvgORYNy3G5k85ImZdSx/dZb7By5RvnN0:8kPRYNyGy8DZdSx/dZHBmR/G

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe

description	pid	process	target process
PID 2012 set thread context of 1384	2012	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exed9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe

pid	process
2012	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe
1384	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe
1384	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe

description	pid	process	target process
PID 2012 wrote to memory of 1384	2012	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe
PID 2012 wrote to memory of 1384	2012	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe
PID 2012 wrote to memory of 1384	2012	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe
PID 2012 wrote to memory of 1384	2012	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe
PID 2012 wrote to memory of 1384	2012	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe
PID 2012 wrote to memory of 1384	2012	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe
PID 2012 wrote to memory of 1384	2012	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe
PID 2012 wrote to memory of 1384	2012	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe
PID 2012 wrote to memory of 1384	2012	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe
PID 2012 wrote to memory of 1384	2012	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe

C:\Users\Admin\AppData\Local\Temp\d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe
"C:\Users\Admin\AppData\Local\Temp\d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012

C:\Users\Admin\AppData\Local\Temp\d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe
a|
2⤵
- Suspicious use of SetWindowsHookEx
PID:1384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1384-56-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1384-57-0x0000000000401210-mapping.dmp

Download
memory/1384-59-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1384-63-0x0000000076AE1000-0x0000000076AE3000-memory.dmp

Filesize
8KB

Download
memory/1384-64-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download