7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe
Size

1.3MB
MD5

76c8665f81d85d077aa285e646dfabca
SHA1

97124b08994fa9904e0e4afbddca1c26da00671a
SHA256

7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153
SHA512

813d7d71c96c1f3110d893f62242c5761a0d04b02fbb502ee0ed4b911d7b976fcf2946fb1e1b54b570309b23fcb0de51df4f84a6295d28522b18b5f3f675d019
SSDEEP

24576:JOiZzDXGLFP53UG7bL1HohIE6BvRx0GOb/4+a0q3bhAqtxe9o:wi1DWLFP53UGe76x0ZUphdtb

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe

description	pid	process	target process
PID 2680 set thread context of 4184	2680	7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe	7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe

pid	process
4184	7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe
4184	7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe
4184	7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe
4184	7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe
4184	7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe

description	pid	process	target process
PID 2680 wrote to memory of 4184	2680	7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe	7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe
PID 2680 wrote to memory of 4184	2680	7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe	7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe
PID 2680 wrote to memory of 4184	2680	7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe	7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe
PID 2680 wrote to memory of 4184	2680	7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe	7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe
PID 2680 wrote to memory of 4184	2680	7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe	7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe
PID 2680 wrote to memory of 4184	2680	7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe	7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe
PID 2680 wrote to memory of 4184	2680	7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe	7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe
PID 2680 wrote to memory of 4184	2680	7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe	7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe
PID 2680 wrote to memory of 4184	2680	7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe	7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe
PID 2680 wrote to memory of 4184	2680	7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe	7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe

C:\Users\Admin\AppData\Local\Temp\7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe
"C:\Users\Admin\AppData\Local\Temp\7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2680

C:\Users\Admin\AppData\Local\Temp\7d33ad17147330ea9ce462c16a022ba45e9010c5319147fe0bc7cd4601e80153.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4184-132-0x0000000000000000-mapping.dmp

Download
memory/4184-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4184-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4184-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4184-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4184-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download