9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf

Analysis

max time kernel
10s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 10:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe
Size

195KB
MD5

c566ab910ed4f09a9fb2d28c4ba54f8b
SHA1

f17b6cb02aa24f31c6787c756bf610b1877cf477
SHA256

9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf
SHA512

f8a953ea9975c2d56ffc432c61a0ec286f18fd072a9b489a1f8a1cb9c7e62a01ad8e973e415634976958f72712003f31355424ff3ddec6648105f73df1be4e52
SSDEEP

1536:bDwgP6hjJqantG4kjxgWGHk/KtKwNPkUGNAT7adRVNSDl29uLBCnnR4an:b56hFqHNKtKW5WATudRVNSIiCian

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 908 set thread context of 1380	908	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1380	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe
1380	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 1380	908	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe	27
PID 908 wrote to memory of 1380	908	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe	27
PID 908 wrote to memory of 1380	908	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe	27
PID 908 wrote to memory of 1380	908	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe	27
PID 908 wrote to memory of 1380	908	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe	27
PID 908 wrote to memory of 1380	908	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe	27
PID 908 wrote to memory of 1380	908	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe	27
PID 908 wrote to memory of 1380	908	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe	27
PID 1380 wrote to memory of 1244	1380	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe	15
PID 1380 wrote to memory of 1244	1380	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe	15
PID 1380 wrote to memory of 1244	1380	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe	15
PID 1380 wrote to memory of 1244	1380	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe	15
PID 1380 wrote to memory of 1244	1380	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe	15
PID 1380 wrote to memory of 1244	1380	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe	15

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1244
- C:\Users\Admin\AppData\Local\Temp\9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe
  "C:\Users\Admin\AppData\Local\Temp\9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Users\Admin\AppData\Local\Temp\9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe
    C:\Users\Admin\AppData\Local\Temp\9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/908-54-0x0000000075021000-0x0000000075023000-memory.dmp

Filesize
8KB

Download
memory/1244-65-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

Filesize
24KB

Download
memory/1380-55-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1380-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1380-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1380-59-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1380-63-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1380-64-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download