7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4

Analysis

max time kernel
199s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe
Size

1.3MB
MD5

e85cc3b3706644827240a127f77b3a83
SHA1

d705e8fd12241b320228ce9efd428152ce513833
SHA256

7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4
SHA512

ef7696d3c6ff1175150072f98fbbb5526620abd71212b34c583afcd54be26a27b2029f629e11e0d71c11bcfbd78c175db873d573a8a6369e2beb4f53bafa1c71
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakq:zrKo4ZwCOnYjVmJPaV

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe

description	pid	process	target process
PID 100 set thread context of 3228	100	7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe	7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe

pid	process
3228	7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe
3228	7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe
3228	7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe
3228	7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe
3228	7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe

description	pid	process	target process
PID 100 wrote to memory of 3228	100	7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe	7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe
PID 100 wrote to memory of 3228	100	7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe	7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe
PID 100 wrote to memory of 3228	100	7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe	7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe
PID 100 wrote to memory of 3228	100	7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe	7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe
PID 100 wrote to memory of 3228	100	7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe	7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe
PID 100 wrote to memory of 3228	100	7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe	7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe
PID 100 wrote to memory of 3228	100	7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe	7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe
PID 100 wrote to memory of 3228	100	7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe	7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe
PID 100 wrote to memory of 3228	100	7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe	7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe
PID 100 wrote to memory of 3228	100	7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe	7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe

C:\Users\Admin\AppData\Local\Temp\7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe
"C:\Users\Admin\AppData\Local\Temp\7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:100

C:\Users\Admin\AppData\Local\Temp\7e8942ea3759e8fcd5536389053ea9e3509f6503c065081d74270ceb71ffafc4.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:3228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3228-132-0x0000000000000000-mapping.dmp

Download
memory/3228-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3228-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3228-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3228-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3228-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3228-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download