7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4

Analysis

max time kernel
338s
max time network
378s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe
Size

1.3MB
MD5

8fe722525d42578a44d666858759af9d
SHA1

ade320ced2ea3d2a26cad96ee1813489b540b027
SHA256

7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4
SHA512

b495bc36185a9ab443ebe94f5eb94433dfa500fcb1fca18a22a35a97d662428aad92e15e74d5996bc4a561f39d42841a4277ad540a2a7465a452da56a19973f9
SSDEEP

24576:rrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak:rrKo4ZwCOnYjVmJPa

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe

description	pid	process	target process
PID 4772 set thread context of 660	4772	7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe	7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe

pid	process
660	7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe
660	7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe
660	7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe
660	7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe
660	7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe

description	pid	process	target process
PID 4772 wrote to memory of 660	4772	7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe	7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe
PID 4772 wrote to memory of 660	4772	7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe	7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe
PID 4772 wrote to memory of 660	4772	7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe	7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe
PID 4772 wrote to memory of 660	4772	7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe	7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe
PID 4772 wrote to memory of 660	4772	7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe	7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe
PID 4772 wrote to memory of 660	4772	7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe	7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe
PID 4772 wrote to memory of 660	4772	7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe	7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe
PID 4772 wrote to memory of 660	4772	7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe	7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe
PID 4772 wrote to memory of 660	4772	7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe	7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe
PID 4772 wrote to memory of 660	4772	7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe	7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe

C:\Users\Admin\AppData\Local\Temp\7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe
"C:\Users\Admin\AppData\Local\Temp\7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4772

C:\Users\Admin\AppData\Local\Temp\7e738a53a7120e11e2c5e3005bd4e44a1c15aa79a152d9d9c0ca7b04f26142f4.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/660-132-0x0000000000000000-mapping.dmp

Download
memory/660-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/660-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/660-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/660-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/660-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download