7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe
Size

1.3MB
MD5

fccd6e15630ff69c0f16179a6cfa3df6
SHA1

707c529c3721343ac06fa4bbd4a664fc7c148fab
SHA256

7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c
SHA512

c5f733f2f381ddc9deff11fed7e08d2ce901f8e0b01dbcb091b56dddf5672f26ce99137fd0c91ed5682b793bfdbabbf41b5f2ea435767545ef70257fb7e011fb
SSDEEP

24576:brKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPaki:brKo4ZwCOnYjVmJPah

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe

description	pid	process	target process
PID 1852 set thread context of 1400	1852	7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe	7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe

pid	process
1400	7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe
1400	7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe
1400	7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe
1400	7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe
1400	7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe

description	pid	process	target process
PID 1852 wrote to memory of 1400	1852	7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe	7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe
PID 1852 wrote to memory of 1400	1852	7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe	7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe
PID 1852 wrote to memory of 1400	1852	7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe	7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe
PID 1852 wrote to memory of 1400	1852	7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe	7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe
PID 1852 wrote to memory of 1400	1852	7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe	7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe
PID 1852 wrote to memory of 1400	1852	7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe	7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe
PID 1852 wrote to memory of 1400	1852	7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe	7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe
PID 1852 wrote to memory of 1400	1852	7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe	7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe
PID 1852 wrote to memory of 1400	1852	7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe	7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe
PID 1852 wrote to memory of 1400	1852	7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe	7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe

C:\Users\Admin\AppData\Local\Temp\7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe
"C:\Users\Admin\AppData\Local\Temp\7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1852

C:\Users\Admin\AppData\Local\Temp\7d45eed675f8a244d7b40cb010e10145e526cf41660a9e16b4bd3c787f89328c.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:1400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1400-133-0x0000000000000000-mapping.dmp

Download
memory/1400-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1400-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1400-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1400-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1400-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download