e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604

Analysis

max time kernel
138s
max time network
162s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 04:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604.exe
Size

84KB
MD5

924a7b08f2f661981a4fb45b1ad3d10d
SHA1

4349667230bb940507e21d56776b77fc2b6f5fe1
SHA256

e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604
SHA512

a831317f5ab97ac4cb0f180e758ff29c9d1635a604feb291e13f01f1d02920fabd9a97fdd825c3321a7e8f76fb728b62ec6590ea0358b14a53a8103a140d8265
SSDEEP

1536:dR73kZV8718aD+1OaHNfhlpJ7PpoxvdEvWP8/LtNT:j3kX8h8C+giNfJfoHEvDztl

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604.exe

description	pid	process	target process
PID 1992 set thread context of 1656	1992	e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604.exe	e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604.exe

pid	process
1992	e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604.exe
1992	e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604.exe

description	pid	process	target process
PID 1992 wrote to memory of 1656	1992	e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604.exe	e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604.exe
PID 1992 wrote to memory of 1656	1992	e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604.exe	e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604.exe
PID 1992 wrote to memory of 1656	1992	e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604.exe	e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604.exe
PID 1992 wrote to memory of 1656	1992	e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604.exe	e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604.exe
PID 1992 wrote to memory of 1656	1992	e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604.exe	e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604.exe
PID 1992 wrote to memory of 1656	1992	e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604.exe	e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604.exe
PID 1992 wrote to memory of 1656	1992	e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604.exe	e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604.exe
PID 1992 wrote to memory of 1656	1992	e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604.exe	e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604.exe
PID 1992 wrote to memory of 1656	1992	e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604.exe	e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604.exe

C:\Users\Admin\AppData\Local\Temp\e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604.exe
"C:\Users\Admin\AppData\Local\Temp\e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992

C:\Users\Admin\AppData\Local\Temp\e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604.exe
C:\Users\Admin\AppData\Local\Temp\e1d30923eea00c471ab3e49836f16ba5b3ca19dff4bd51fd600ad55e688c4604.exe
2⤵
PID:1656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1656-55-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1656-56-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1656-58-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1656-59-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1656-60-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1656-61-0x0000000000404041-mapping.dmp

Download
memory/1656-65-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1992-54-0x0000000075F61000-0x0000000075F63000-memory.dmp

Filesize
8KB

Download
memory/1992-62-0x0000000000320000-0x0000000000324000-memory.dmp

Filesize
16KB

Download