aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72

Analysis

max time kernel
25s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe
Size

112KB
MD5

6a37d9a8389337d37523d16b2c502db0
SHA1

1ca9b32ba7dac66d47431975daeeb90165893715
SHA256

aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72
SHA512

fc70d44614f68b5772faab89216391be849b9e35e36ec70e68ff28c421013cdc2b8779368358c5ee2919478556603fa6d8fb035be791dc886d3f5d3de127f32d
SSDEEP

3072:r6IuIt6lTnc7oh1FKMw1NPItHgEQSyGhjXsP:PuIt6lI7mKMwHTSts

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe

description	pid	process	target process
PID 880 set thread context of 632	880	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe

description	pid	process	target process
PID 880 wrote to memory of 1376	880	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe
PID 880 wrote to memory of 1376	880	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe
PID 880 wrote to memory of 1376	880	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe
PID 880 wrote to memory of 1376	880	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe
PID 880 wrote to memory of 632	880	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe
PID 880 wrote to memory of 632	880	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe
PID 880 wrote to memory of 632	880	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe
PID 880 wrote to memory of 632	880	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe
PID 880 wrote to memory of 632	880	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe
PID 880 wrote to memory of 632	880	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe
PID 880 wrote to memory of 632	880	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe
PID 880 wrote to memory of 632	880	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe

C:\Users\Admin\AppData\Local\Temp\aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe
"C:\Users\Admin\AppData\Local\Temp\aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:880

C:\Users\Admin\AppData\Local\Temp\aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe
"C:\Users\Admin\AppData\Local\Temp\aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe"
2⤵
PID:1376

C:\Users\Admin\AppData\Local\Temp\aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe
"C:\Users\Admin\AppData\Local\Temp\aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe"
2⤵
PID:632

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/632-56-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/632-57-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/632-59-0x00000000011E729E-mapping.dmp

Download
memory/632-62-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/880-54-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/880-55-0x0000000074CE0000-0x000000007528B000-memory.dmp

Filesize
5.7MB

Download
memory/880-61-0x0000000074CE0000-0x000000007528B000-memory.dmp

Filesize
5.7MB

Download