7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd

Analysis

max time kernel
3s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 22:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe
Size

221KB
MD5

3081241a661c2affbbc9464189c4126c
SHA1

a0ab4b4b65709bb5088822af9261659fb3c8e7af
SHA256

7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd
SHA512

c125c0b77eb13e58fdbbf548032cb58527227d4b590fe5eda64ef3182b88b9b979b874544587852f9696da789e1015aa765ef7603307856befd78f720ea54031
SSDEEP

3072:1OwZr1Z1iYoQ0rBY1HARieUNAXQNMCGg85S8rXRziTe9VBhpAelSFmE3w8PVju96:1HiygRieqzGNuTYBhpAemmnwjumjp

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1396	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
904	7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 904 set thread context of 1396	904	7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe	27

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 1396	904	7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe	27
PID 904 wrote to memory of 1396	904	7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe	27
PID 904 wrote to memory of 1396	904	7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe	27
PID 904 wrote to memory of 1396	904	7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe	27
PID 904 wrote to memory of 1396	904	7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe	27
PID 904 wrote to memory of 1396	904	7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe	27
PID 904 wrote to memory of 1396	904	7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe	27
PID 904 wrote to memory of 1396	904	7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe	27
PID 904 wrote to memory of 1396	904	7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe	27
PID 904 wrote to memory of 1396	904	7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe	27
PID 904 wrote to memory of 1396	904	7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe	27
PID 904 wrote to memory of 1396	904	7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe	27

C:\Users\Admin\AppData\Local\Temp\7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe
"C:\Users\Admin\AppData\Local\Temp\7493f537a2813a6d0febbf09592d8423b912457631160b550ad519e6fbfa92dd.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:904
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\svchost.exe
  2⤵
  - Executes dropped EXE
  PID:1396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
memory/904-54-0x0000000075661000-0x0000000075663000-memory.dmp

Filesize
8KB

Download
memory/904-70-0x0000000074420000-0x00000000749CB000-memory.dmp

Filesize
5.7MB

Download
memory/1396-62-0x0000000011490000-0x00000000114B8000-memory.dmp

Filesize
160KB

Download
memory/1396-60-0x0000000011490000-0x00000000114B8000-memory.dmp

Filesize
160KB

Download
memory/1396-59-0x0000000011490000-0x00000000114B8000-memory.dmp

Filesize
160KB

Download
memory/1396-63-0x0000000011490000-0x00000000114B8000-memory.dmp

Filesize
160KB

Download
memory/1396-65-0x0000000011490000-0x00000000114B8000-memory.dmp

Filesize
160KB

Download
memory/1396-67-0x0000000011490000-0x00000000114B8000-memory.dmp

Filesize
160KB

Download
memory/1396-57-0x0000000011490000-0x00000000114B8000-memory.dmp

Filesize
160KB

Download
memory/1396-56-0x0000000011490000-0x00000000114B8000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads