7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f

Analysis

max time kernel
164s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe
Size

1.6MB
MD5

df53fadc8ea036d552e87b8c0174c77d
SHA1

9700e42dcdcc627d3359fe8d8231e59fe5f02170
SHA256

7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f
SHA512

9781c442d9c4c2af4d4607e87fc79da4e9d2819ae8bdbb38f27e71c6d0c4219d1a32f410b2da65c5052d75252156ea30ce1ee9c6121eb5c946a04886d75bf91d
SSDEEP

24576:NzD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUYP:n6/ye0PIphrp9Zuvjqa0UidY

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe

description	pid	process	target process
PID 3664 set thread context of 564	3664	7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe	7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe

pid	process
564	7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe
564	7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe
564	7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe
564	7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe
564	7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe

description	pid	process	target process
PID 3664 wrote to memory of 564	3664	7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe	7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe
PID 3664 wrote to memory of 564	3664	7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe	7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe
PID 3664 wrote to memory of 564	3664	7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe	7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe
PID 3664 wrote to memory of 564	3664	7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe	7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe
PID 3664 wrote to memory of 564	3664	7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe	7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe
PID 3664 wrote to memory of 564	3664	7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe	7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe
PID 3664 wrote to memory of 564	3664	7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe	7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe
PID 3664 wrote to memory of 564	3664	7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe	7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe
PID 3664 wrote to memory of 564	3664	7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe	7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe
PID 3664 wrote to memory of 564	3664	7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe	7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe

C:\Users\Admin\AppData\Local\Temp\7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe
"C:\Users\Admin\AppData\Local\Temp\7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3664

C:\Users\Admin\AppData\Local\Temp\7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe
"C:\Users\Admin\AppData\Local\Temp\7cb1c77a2140ad2c1d1261cf011a498ca8c0186fce7c664cc1edf464921ec02f.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/564-132-0x0000000000000000-mapping.dmp

Download
memory/564-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/564-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/564-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/564-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/564-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/564-138-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download