Analysis
-
max time kernel
91s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 16:20
Static task
static1
Behavioral task
behavioral1
Sample
7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe
Resource
win10v2004-20220901-en
General
-
Target
7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe
-
Size
1.3MB
-
MD5
a6e4165f46c3b02603642cc8ca064fd9
-
SHA1
80e9eeca9b4be75fb906bcf496fa5d0d354e27f7
-
SHA256
7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7
-
SHA512
af17774d8477cab6ec585f2200219210025ad63f83bb637e5f791eef8cb8122aa70973b4e7cf9ccb5f7da724eb78e76face38a2e211d6d2a4f70a8a75f9987a4
-
SSDEEP
24576:GKyKz4D4ufmwhzA2QoPKCys7JdpmnMlxy9KR8uQcuj:GKVzMNuwIKyoBmnMSURNQD
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4904 set thread context of 4940 4904 7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe 81 -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4940 7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe 4940 7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe 4940 7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe 4940 7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe 4940 7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4904 wrote to memory of 4940 4904 7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe 81 PID 4904 wrote to memory of 4940 4904 7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe 81 PID 4904 wrote to memory of 4940 4904 7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe 81 PID 4904 wrote to memory of 4940 4904 7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe 81 PID 4904 wrote to memory of 4940 4904 7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe 81 PID 4904 wrote to memory of 4940 4904 7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe 81 PID 4904 wrote to memory of 4940 4904 7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe 81 PID 4904 wrote to memory of 4940 4904 7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe 81 PID 4904 wrote to memory of 4940 4904 7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe 81 PID 4904 wrote to memory of 4940 4904 7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe"C:\Users\Admin\AppData\Local\Temp\7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe
- Suspicious use of SetWindowsHookEx
PID:4940
-