96fb336dfa9e003e49fc24861ad5db68301c890847372be1d44ba6d201e297bd

Analysis

max time kernel
25s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 08:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

96fb336dfa9e003e49fc24861ad5db68301c890847372be1d44ba6d201e297bd.exe
Size

146KB
MD5

91a86837eabc1eb3f187eee77b05cfe6
SHA1

d6ed91f1fc70397ec80099c840aa29eadfd1e98b
SHA256

96fb336dfa9e003e49fc24861ad5db68301c890847372be1d44ba6d201e297bd
SHA512

601cfeb330f01a0d5365594da0ef2377ebd5363c76b1ca1dd4dbc15e0d5b8dc742ec5332347e9fd2e543cc5c59bf4d4530d9ee22f269a58c6c31796cbffc92ad
SSDEEP

3072:TSbFBqb9iNlmtOaeDdViS17GLpqmhscrwbmEYKFhES:+b387tOP1NGQm3rwbmAFhES

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2032 set thread context of 1744	2032	96fb336dfa9e003e49fc24861ad5db68301c890847372be1d44ba6d201e297bd.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2032	96fb336dfa9e003e49fc24861ad5db68301c890847372be1d44ba6d201e297bd.exe
1744	96fb336dfa9e003e49fc24861ad5db68301c890847372be1d44ba6d201e297bd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2032	96fb336dfa9e003e49fc24861ad5db68301c890847372be1d44ba6d201e297bd.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1744	2032	96fb336dfa9e003e49fc24861ad5db68301c890847372be1d44ba6d201e297bd.exe	28
PID 2032 wrote to memory of 1744	2032	96fb336dfa9e003e49fc24861ad5db68301c890847372be1d44ba6d201e297bd.exe	28
PID 2032 wrote to memory of 1744	2032	96fb336dfa9e003e49fc24861ad5db68301c890847372be1d44ba6d201e297bd.exe	28
PID 2032 wrote to memory of 1744	2032	96fb336dfa9e003e49fc24861ad5db68301c890847372be1d44ba6d201e297bd.exe	28
PID 2032 wrote to memory of 1744	2032	96fb336dfa9e003e49fc24861ad5db68301c890847372be1d44ba6d201e297bd.exe	28
PID 2032 wrote to memory of 1744	2032	96fb336dfa9e003e49fc24861ad5db68301c890847372be1d44ba6d201e297bd.exe	28
PID 2032 wrote to memory of 1744	2032	96fb336dfa9e003e49fc24861ad5db68301c890847372be1d44ba6d201e297bd.exe	28
PID 2032 wrote to memory of 1744	2032	96fb336dfa9e003e49fc24861ad5db68301c890847372be1d44ba6d201e297bd.exe	28
PID 2032 wrote to memory of 1744	2032	96fb336dfa9e003e49fc24861ad5db68301c890847372be1d44ba6d201e297bd.exe	28
PID 1744 wrote to memory of 1268	1744	96fb336dfa9e003e49fc24861ad5db68301c890847372be1d44ba6d201e297bd.exe	7
PID 1744 wrote to memory of 1268	1744	96fb336dfa9e003e49fc24861ad5db68301c890847372be1d44ba6d201e297bd.exe	7
PID 1744 wrote to memory of 1268	1744	96fb336dfa9e003e49fc24861ad5db68301c890847372be1d44ba6d201e297bd.exe	7
PID 1744 wrote to memory of 1268	1744	96fb336dfa9e003e49fc24861ad5db68301c890847372be1d44ba6d201e297bd.exe	7
PID 1744 wrote to memory of 1268	1744	96fb336dfa9e003e49fc24861ad5db68301c890847372be1d44ba6d201e297bd.exe	7

C:\Users\Admin\AppData\Local\Temp\96fb336dfa9e003e49fc24861ad5db68301c890847372be1d44ba6d201e297bd.exe
"C:\Users\Admin\AppData\Local\Temp\96fb336dfa9e003e49fc24861ad5db68301c890847372be1d44ba6d201e297bd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\AppData\Local\Temp\96fb336dfa9e003e49fc24861ad5db68301c890847372be1d44ba6d201e297bd.exe
  C:\Users\Admin\AppData\Local\Temp\96fb336dfa9e003e49fc24861ad5db68301c890847372be1d44ba6d201e297bd.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1744

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1744-64-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1744-58-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1744-62-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1744-60-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1744-57-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1744-67-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1744-68-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download
memory/1744-71-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1744-73-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2032-56-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2032-70-0x00000000003D0000-0x00000000003F6000-memory.dmp

Filesize
152KB

Download
memory/2032-72-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download