ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a

Analysis

max time kernel
34s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 17:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe
Size

713KB
MD5

122f2660726828a2287181960fb34a29
SHA1

6201a4d842c69acd14ec1a34f77bbecf990b257b
SHA256

ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a
SHA512

b8a787ce0a1a36f4d6632632f79d0342342b9309602142d0ab0b6e83856acc9627b45a8bdc6e170a67e7cb7e9d2bdca15f853ffb1ec1e81733a2014ed5a579e9
SSDEEP

6144:/bxLga+iFcalraBCDorABG9oUwd8curaBCDopAIz:/KB4calraBvnraBr

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1672-56-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral1/memory/1672-65-0x0000000000400000-0x00000000004B4000-memory.dmp	upx

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 1672 set thread context of 696	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe	27
PID 1672 set thread context of 0	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe
PID 1672 set thread context of 0	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe
PID 1672 set thread context of 0	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe
PID 1672 set thread context of 0	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe
PID 1672 set thread context of 0	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
696	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe
696	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 696	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe	27
PID 1672 wrote to memory of 696	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe	27
PID 1672 wrote to memory of 696	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe	27
PID 1672 wrote to memory of 696	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe	27
PID 1672 wrote to memory of 696	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe	27
PID 1672 wrote to memory of 696	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe	27
PID 1672 wrote to memory of 696	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe	27
PID 1672 wrote to memory of 696	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe	27
PID 1672 wrote to memory of 0	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe
PID 1672 wrote to memory of 0	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe
PID 1672 wrote to memory of 0	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe
PID 1672 wrote to memory of 0	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe
PID 1672 wrote to memory of 0	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe
PID 1672 wrote to memory of 0	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe
PID 1672 wrote to memory of 0	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe
PID 1672 wrote to memory of 0	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe
PID 1672 wrote to memory of 0	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe
PID 1672 wrote to memory of 0	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe
PID 1672 wrote to memory of 0	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe
PID 1672 wrote to memory of 0	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe
PID 1672 wrote to memory of 0	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe
PID 1672 wrote to memory of 0	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe
PID 1672 wrote to memory of 0	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe
PID 1672 wrote to memory of 0	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe
PID 1672 wrote to memory of 0	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe
PID 1672 wrote to memory of 0	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe
PID 1672 wrote to memory of 0	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe
PID 1672 wrote to memory of 0	1672	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe
PID 696 wrote to memory of 1260	696	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe	14
PID 696 wrote to memory of 1260	696	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe	14
PID 696 wrote to memory of 1260	696	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe	14
PID 696 wrote to memory of 1260	696	ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe	14

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1260
- C:\Users\Admin\AppData\Local\Temp\ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe
  "C:\Users\Admin\AppData\Local\Temp\ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Users\Admin\AppData\Local\Temp\ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe
    "C:\Users\Admin\AppData\Local\Temp\ea7c188a458e11e44850e5335967850f8e04fe35a5f95bee86329f55dc3ddc3a.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/0-60-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/0-64-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/696-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/696-58-0x0000000000407C89-mapping.dmp

Download
memory/696-66-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/696-67-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download
memory/696-71-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1260-68-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1672-56-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/1672-65-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download