67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 04:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe
Size

54KB
MD5

e623fa41d5df762ef3fb185b92a4ee36
SHA1

72d63c4eb50370765c776f1dd86100accff9058c
SHA256

67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286
SHA512

c5ee27d5756a88c130427e3a0d0440e6eafd9c52a69fc29de054e5b5600a6a0bba5b76daa06e075d55369f2f16199131d739db86ed7bf3b677a5858aa61b75b6
SSDEEP

768:VCQXtb3VdFbaeNsovJ1fgg/jTVa4MT87G9kVTiiYZe6Dm9Wb7rT364c0L1hF:VxV5sU1f3T9niiIe6D4Wn64JLLF

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe

description	pid	process	target process
PID 1160 set thread context of 1868	1160	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe

pid	process
1868	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe
1868	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe

description	pid	process	target process
PID 1160 wrote to memory of 1868	1160	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe
PID 1160 wrote to memory of 1868	1160	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe
PID 1160 wrote to memory of 1868	1160	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe
PID 1160 wrote to memory of 1868	1160	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe
PID 1160 wrote to memory of 1868	1160	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe
PID 1160 wrote to memory of 1868	1160	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe
PID 1160 wrote to memory of 1868	1160	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe
PID 1160 wrote to memory of 1868	1160	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe
PID 1160 wrote to memory of 1868	1160	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe
PID 1868 wrote to memory of 1276	1868	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe	Explorer.EXE
PID 1868 wrote to memory of 1276	1868	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe	Explorer.EXE
PID 1868 wrote to memory of 1276	1868	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe	Explorer.EXE
PID 1868 wrote to memory of 1276	1868	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1276

C:\Users\Admin\AppData\Local\Temp\67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe
"C:\Users\Admin\AppData\Local\Temp\67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1160

C:\Users\Admin\AppData\Local\Temp\67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe
C:\Users\Admin\AppData\Local\Temp\67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1160-54-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/1276-60-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1868-55-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1868-56-0x0000000000407C89-mapping.dmp

Download
memory/1868-59-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1868-63-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1868-64-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download