e8e45a62cd2eabe03565eed183aa37b6c2e320565e32ce6b6df1ea0825897b39

Analysis

max time kernel
70s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06/05/2023, 12:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OYqcYh.exe
Size

2.5MB
MD5

16d5574261f9687345e346d82d445f48
SHA1

4f859e3882732f265376d0ebf139a065909f74f5
SHA256

e8e45a62cd2eabe03565eed183aa37b6c2e320565e32ce6b6df1ea0825897b39
SHA512

a66901bec9a90beb845f5a2e22b25576d4c45e03fdf626ec636f9f10148b2b200dacd1668285d651662251da14d7badb4ab98deff31a9ec3e8ae960aaaa2ca0e
SSDEEP

49152:44OQKz2hZfs+53wyDN2Y0jtnPvYHpYKFsB0nJCa8B2GQgyK:ZOQKz2z5P895wlsCnDG

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1408 set thread context of 1528	1408	OYqcYh.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 1528	1408	OYqcYh.exe	28
PID 1408 wrote to memory of 1528	1408	OYqcYh.exe	28
PID 1408 wrote to memory of 1528	1408	OYqcYh.exe	28
PID 1408 wrote to memory of 1528	1408	OYqcYh.exe	28
PID 1408 wrote to memory of 1528	1408	OYqcYh.exe	28
PID 1408 wrote to memory of 1528	1408	OYqcYh.exe	28
PID 1408 wrote to memory of 1528	1408	OYqcYh.exe	28
PID 1408 wrote to memory of 1528	1408	OYqcYh.exe	28
PID 1408 wrote to memory of 1528	1408	OYqcYh.exe	28

C:\Users\Admin\AppData\Local\Temp\OYqcYh.exe
"C:\Users\Admin\AppData\Local\Temp\OYqcYh.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Users\Admin\AppData\Local\Temp\OYqcYh.exe
  "C:\Users\Admin\AppData\Local\Temp\OYqcYh.exe"
  2⤵
  PID:1528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1408-54-0x00000000013B0000-0x0000000001632000-memory.dmp

Filesize
2.5MB

Download
memory/1408-55-0x00000000012D0000-0x0000000001310000-memory.dmp

Filesize
256KB

Download
memory/1408-56-0x0000000000610000-0x0000000000622000-memory.dmp

Filesize
72KB

Download
memory/1408-57-0x00000000012D0000-0x0000000001310000-memory.dmp

Filesize
256KB

Download
memory/1408-58-0x0000000000670000-0x000000000067C000-memory.dmp

Filesize
48KB

Download
memory/1408-59-0x0000000008AE0000-0x0000000008D24000-memory.dmp

Filesize
2.3MB

Download
memory/1408-60-0x000000000C4E0000-0x000000000C70A000-memory.dmp

Filesize
2.2MB

Download
memory/1528-61-0x0000000000400000-0x0000000000610000-memory.dmp

Filesize
2.1MB

Download
memory/1528-62-0x0000000000400000-0x0000000000610000-memory.dmp

Filesize
2.1MB

Download
memory/1528-63-0x0000000000400000-0x0000000000610000-memory.dmp

Filesize
2.1MB

Download
memory/1528-64-0x0000000000400000-0x0000000000610000-memory.dmp

Filesize
2.1MB

Download
memory/1528-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1528-66-0x0000000000400000-0x0000000000610000-memory.dmp

Filesize
2.1MB

Download
memory/1528-68-0x0000000000400000-0x0000000000610000-memory.dmp

Filesize
2.1MB

Download
memory/1528-70-0x0000000000400000-0x0000000000610000-memory.dmp

Filesize
2.1MB

Download
memory/1528-71-0x0000000001320000-0x0000000001360000-memory.dmp

Filesize
256KB

Download
memory/1528-72-0x0000000001320000-0x0000000001360000-memory.dmp

Filesize
256KB

Download
memory/1528-73-0x0000000001320000-0x0000000001360000-memory.dmp

Filesize
256KB

Download
memory/1528-74-0x0000000001320000-0x0000000001360000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads