c6fb8049a45e370a5dfb11799d7fd03abb8b9b0a47599987b134475d447e02f1

Analysis

max time kernel
25s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 08:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c6fb8049a45e370a5dfb11799d7fd03abb8b9b0a47599987b134475d447e02f1.exe
Size

380KB
MD5

d594b718e03dd38cc0da767319e973c7
SHA1

06ab80a7d15c0a8d9b793c24fd8eef522c6eb922
SHA256

c6fb8049a45e370a5dfb11799d7fd03abb8b9b0a47599987b134475d447e02f1
SHA512

3aa35908a4818e40a3ab29e591bc78e09354cf4c61042847509340e77ee9b607ff7b2e6841959d81a60cea1d66fb2d37a3de1e589bdba57c5beff05eb6e84ac5
SSDEEP

6144:6cjhFkXEPOeVVk0R/fJFK2QXd85QhfNwtcq7xNb6L9QlEP7tSxK7KglNSTuCdaGC:fjhceVVk0R/fJFK2QXd85QhfNwtcq7xU

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1232 set thread context of 1528	1232	c6fb8049a45e370a5dfb11799d7fd03abb8b9b0a47599987b134475d447e02f1.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1528	c6fb8049a45e370a5dfb11799d7fd03abb8b9b0a47599987b134475d447e02f1.exe
1528	c6fb8049a45e370a5dfb11799d7fd03abb8b9b0a47599987b134475d447e02f1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1232	c6fb8049a45e370a5dfb11799d7fd03abb8b9b0a47599987b134475d447e02f1.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 1528	1232	c6fb8049a45e370a5dfb11799d7fd03abb8b9b0a47599987b134475d447e02f1.exe	28
PID 1232 wrote to memory of 1528	1232	c6fb8049a45e370a5dfb11799d7fd03abb8b9b0a47599987b134475d447e02f1.exe	28
PID 1232 wrote to memory of 1528	1232	c6fb8049a45e370a5dfb11799d7fd03abb8b9b0a47599987b134475d447e02f1.exe	28
PID 1232 wrote to memory of 1528	1232	c6fb8049a45e370a5dfb11799d7fd03abb8b9b0a47599987b134475d447e02f1.exe	28
PID 1232 wrote to memory of 1528	1232	c6fb8049a45e370a5dfb11799d7fd03abb8b9b0a47599987b134475d447e02f1.exe	28
PID 1232 wrote to memory of 1528	1232	c6fb8049a45e370a5dfb11799d7fd03abb8b9b0a47599987b134475d447e02f1.exe	28
PID 1232 wrote to memory of 1528	1232	c6fb8049a45e370a5dfb11799d7fd03abb8b9b0a47599987b134475d447e02f1.exe	28
PID 1232 wrote to memory of 1528	1232	c6fb8049a45e370a5dfb11799d7fd03abb8b9b0a47599987b134475d447e02f1.exe	28
PID 1528 wrote to memory of 1336	1528	c6fb8049a45e370a5dfb11799d7fd03abb8b9b0a47599987b134475d447e02f1.exe	26
PID 1528 wrote to memory of 1336	1528	c6fb8049a45e370a5dfb11799d7fd03abb8b9b0a47599987b134475d447e02f1.exe	26
PID 1528 wrote to memory of 1336	1528	c6fb8049a45e370a5dfb11799d7fd03abb8b9b0a47599987b134475d447e02f1.exe	26
PID 1528 wrote to memory of 1336	1528	c6fb8049a45e370a5dfb11799d7fd03abb8b9b0a47599987b134475d447e02f1.exe	26
PID 1528 wrote to memory of 1336	1528	c6fb8049a45e370a5dfb11799d7fd03abb8b9b0a47599987b134475d447e02f1.exe	26
PID 1528 wrote to memory of 1336	1528	c6fb8049a45e370a5dfb11799d7fd03abb8b9b0a47599987b134475d447e02f1.exe	26

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1336
- C:\Users\Admin\AppData\Local\Temp\c6fb8049a45e370a5dfb11799d7fd03abb8b9b0a47599987b134475d447e02f1.exe
  "C:\Users\Admin\AppData\Local\Temp\c6fb8049a45e370a5dfb11799d7fd03abb8b9b0a47599987b134475d447e02f1.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Users\Admin\AppData\Local\Temp\c6fb8049a45e370a5dfb11799d7fd03abb8b9b0a47599987b134475d447e02f1.exe
    C:\Users\Admin\AppData\Local\Temp\c6fb8049a45e370a5dfb11799d7fd03abb8b9b0a47599987b134475d447e02f1.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1232-54-0x0000000000400000-0x000000000097043B-memory.dmp

Filesize
5.4MB

Download
memory/1232-57-0x0000000000400000-0x000000000097043B-memory.dmp

Filesize
5.4MB

Download
memory/1232-65-0x0000000000400000-0x000000000097043B-memory.dmp

Filesize
5.4MB

Download
memory/1336-69-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

Filesize
24KB

Download
memory/1528-62-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1528-61-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1528-59-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1528-66-0x0000000075C31000-0x0000000075C33000-memory.dmp

Filesize
8KB

Download
memory/1528-67-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1528-68-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/1528-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1528-72-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download