bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683

Analysis

max time kernel
74s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 20:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe
Size

641KB
MD5

bd21b3a94164bd92ab510a486546b927
SHA1

500d691b127512183761ebc62cc3362e5a53ba0d
SHA256

bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683
SHA512

682955d0d668b61581928e78016f6dc133ea280e74da77d973ace918320eedb07b5dbac9e2ce30f678b50da3826e33190193bfb39d21ee567d26b7a2d61dc191
SSDEEP

12288:wmMG9IuqGVUrOFDpEw+LOcBBkpwTWnLUlRFTxo4yD9ENQ5xVkA1FbeZn:wmMjuFCAUOcBBrWnLUlmOOP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 856 set thread context of 1540	856	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe	27

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 892	856	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe	26
PID 856 wrote to memory of 892	856	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe	26
PID 856 wrote to memory of 892	856	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe	26
PID 856 wrote to memory of 892	856	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe	26
PID 856 wrote to memory of 892	856	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe	26
PID 856 wrote to memory of 892	856	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe	26
PID 856 wrote to memory of 892	856	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe	26
PID 856 wrote to memory of 1540	856	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe	27
PID 856 wrote to memory of 1540	856	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe	27
PID 856 wrote to memory of 1540	856	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe	27
PID 856 wrote to memory of 1540	856	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe	27
PID 856 wrote to memory of 1540	856	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe	27
PID 856 wrote to memory of 1540	856	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe	27
PID 856 wrote to memory of 1540	856	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe	27
PID 856 wrote to memory of 1540	856	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe	27
PID 856 wrote to memory of 1540	856	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe	27
PID 856 wrote to memory of 1540	856	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe	27
PID 856 wrote to memory of 1540	856	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe	27
PID 856 wrote to memory of 1540	856	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe	27
PID 856 wrote to memory of 1540	856	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe	27

C:\Users\Admin\AppData\Local\Temp\bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe
"C:\Users\Admin\AppData\Local\Temp\bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:856
- C:\Users\Admin\AppData\Local\Temp\bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe
  "C:\Users\Admin\AppData\Local\Temp\bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe"
  2⤵
  PID:892
- C:\Users\Admin\AppData\Local\Temp\bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe
  "C:\Users\Admin\AppData\Local\Temp\bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe"
  2⤵
  PID:1540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/856-54-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download
memory/856-55-0x0000000000370000-0x0000000000416000-memory.dmp

Filesize
664KB

Download
memory/856-56-0x0000000000340000-0x0000000000348000-memory.dmp

Filesize
32KB

Download
memory/856-57-0x00000000053E0000-0x0000000005470000-memory.dmp

Filesize
576KB

Download
memory/1540-58-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/1540-59-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/1540-61-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/1540-63-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/1540-66-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/1540-68-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/1540-70-0x00000000004A347E-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads