7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595

Analysis

max time kernel
172s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe
Size

1.5MB
MD5

923116771a91cb25a9b02c68069552a0
SHA1

d3aa99e2fe6bf37ffeff49b403375fd7b1f87765
SHA256

7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595
SHA512

62d8880e304aa0afb386fd524fdd1d33e387df801511f430793642c518f38667af3caff279b430f0f0458d13d42868e4da3e3ea7637a775e86897f61cd6ee738
SSDEEP

24576:1zD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUYW:P6/ye0PIphrp9Zuvjqa0UidF

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe

description	pid	process	target process
PID 1448 set thread context of 2656	1448	7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe	7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe

pid	process
2656	7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe
2656	7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe
2656	7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe
2656	7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe
2656	7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe

description	pid	process	target process
PID 1448 wrote to memory of 2656	1448	7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe	7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe
PID 1448 wrote to memory of 2656	1448	7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe	7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe
PID 1448 wrote to memory of 2656	1448	7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe	7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe
PID 1448 wrote to memory of 2656	1448	7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe	7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe
PID 1448 wrote to memory of 2656	1448	7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe	7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe
PID 1448 wrote to memory of 2656	1448	7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe	7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe
PID 1448 wrote to memory of 2656	1448	7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe	7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe
PID 1448 wrote to memory of 2656	1448	7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe	7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe
PID 1448 wrote to memory of 2656	1448	7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe	7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe
PID 1448 wrote to memory of 2656	1448	7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe	7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe

C:\Users\Admin\AppData\Local\Temp\7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe
"C:\Users\Admin\AppData\Local\Temp\7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1448

C:\Users\Admin\AppData\Local\Temp\7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe
"C:\Users\Admin\AppData\Local\Temp\7cf2c73d5848aadbee0411500b343ad4f222bc78007db2fecd7090ad65b0a595.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:2656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2656-132-0x0000000000000000-mapping.dmp

Download
memory/2656-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2656-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2656-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2656-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2656-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download