8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb

Analysis

max time kernel
45s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 16:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe
Size

240KB
MD5

3190ff5d6a10ae23c287461620fb60f6
SHA1

7dbab456f5f49ec478a5760dbbc02d2e94572270
SHA256

8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb
SHA512

256957c6d9bc8ef5f8b9758b9294e5bdc352a64a785e829b203d087695efb13b1d5cb6807711c546721ca5f53590ce9110833283754b071fb3e8c584583af881
SSDEEP

3072:I2tgYhx2fEbUVwogZfYagZfYAgZfYlCxdw3SC6:DMVAZwZZwLZwledwA

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe

description	pid	process	target process
PID 1956 set thread context of 944	1956	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe

pid	process
944	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe
944	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe

pid process

1956 8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe

pid	process
1956	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe

description	pid	process	target process
PID 1956 wrote to memory of 944	1956	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe
PID 1956 wrote to memory of 944	1956	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe
PID 1956 wrote to memory of 944	1956	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe
PID 1956 wrote to memory of 944	1956	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe
PID 1956 wrote to memory of 944	1956	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe
PID 1956 wrote to memory of 944	1956	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe
PID 1956 wrote to memory of 944	1956	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe
PID 1956 wrote to memory of 944	1956	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe
PID 944 wrote to memory of 1220	944	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe	Explorer.EXE
PID 944 wrote to memory of 1220	944	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe	Explorer.EXE
PID 944 wrote to memory of 1220	944	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe	Explorer.EXE
PID 944 wrote to memory of 1220	944	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1220
- C:\Users\Admin\AppData\Local\Temp\8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe
  "C:\Users\Admin\AppData\Local\Temp\8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Users\Admin\AppData\Local\Temp\8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe
    "C:\Users\Admin\AppData\Local\Temp\8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/944-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/944-57-0x0000000000407C89-mapping.dmp

Download
memory/944-59-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/944-60-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download
memory/944-64-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/944-65-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1220-61-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download