b2989e35351b59cd09af94f5c34a219c62c3a9dadd916388e383b3cf1681784c | Triage

Analysis

max time kernel
22s
max time network
48s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 22:52

Sharing

Report Analysis Logs

General

Target

ppi.exe
Size

364KB
MD5

c16a58796b7d10ea3e812e7e55c274ee
SHA1

ea985f6d2ac90fd652f298a3183166ce2b1a58e1
SHA256

04f804ae6a9bb208121454bc909a212b272c92adc1c1d24353e08320a3485646
SHA512

f51d5c33d3254bdc3d9b950c95f832a758c2ba4575ef474638f361dd740b84781cf3333130d3797e0fe4aa539a5bebe6f5e7032c99d5cd12fa555f80047c2f65
SSDEEP

6144:RqxjFV8M94cGTy5SPakDDQjqlFMURWxrSzZmz4:A74bAwVMMjmz

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1236 set thread context of 340	1236	ppi.exe	28

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1236	ppi.exe
340	ppi.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 340	1236	ppi.exe	28
PID 1236 wrote to memory of 340	1236	ppi.exe	28
PID 1236 wrote to memory of 340	1236	ppi.exe	28
PID 1236 wrote to memory of 340	1236	ppi.exe	28
PID 1236 wrote to memory of 340	1236	ppi.exe	28
PID 1236 wrote to memory of 340	1236	ppi.exe	28
PID 1236 wrote to memory of 340	1236	ppi.exe	28
PID 1236 wrote to memory of 340	1236	ppi.exe	28
PID 1236 wrote to memory of 340	1236	ppi.exe	28

C:\Users\Admin\AppData\Local\Temp\ppi.exe
"C:\Users\Admin\AppData\Local\Temp\ppi.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Users\Admin\AppData\Local\Temp\ppi.exe
  "C:\Users\Admin\AppData\Local\Temp\ppi.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/340-56-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/340-61-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/340-62-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download