Analysis

  • max time kernel
    150s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230621-en
  • resource tags

    arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
  • submitted
    24-06-2023 18:19

General

  • Target

    276d2547a322342d5f234e20aafccea79137832c3ec6d1cd867aae3e501b267f.exe

  • Size

    3.8MB

  • MD5

    1b9a91c90c92f96e04e22985fa8d83ee

  • SHA1

    de241cf6fb5edc0d9df6bf045d74df86290f6d6e

  • SHA256

    276d2547a322342d5f234e20aafccea79137832c3ec6d1cd867aae3e501b267f

  • SHA512

    543ca11ae4ef40c1b15d189adba7d2e53306e6dca62e4c025fbad6599e9a17e41eb46f6cb3b69908d91cfc4b3de99ebb2ba1d49a569c505396cc7b094c227a0d

  • SSDEEP

    98304:kxLWmmRCCOFH0nGi2lnlwL4MqkLgHZ10gPNQh:OoaSGbnlcajHZOgPuh

Score
1/10

Malware Config

Signatures

  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\276d2547a322342d5f234e20aafccea79137832c3ec6d1cd867aae3e501b267f.exe
    "C:\Users\Admin\AppData\Local\Temp\276d2547a322342d5f234e20aafccea79137832c3ec6d1cd867aae3e501b267f.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:828
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1172

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/828-54-0x0000000000400000-0x00000000012C4000-memory.dmp

      Filesize

      14.8MB

    • memory/828-55-0x0000000000400000-0x00000000012C4000-memory.dmp

      Filesize

      14.8MB

    • memory/828-56-0x0000000000400000-0x00000000012C4000-memory.dmp

      Filesize

      14.8MB

    • memory/828-57-0x0000000000400000-0x00000000012C4000-memory.dmp

      Filesize

      14.8MB

    • memory/828-59-0x0000000000400000-0x00000000012C4000-memory.dmp

      Filesize

      14.8MB

    • memory/828-60-0x00000000001B0000-0x00000000001B1000-memory.dmp

      Filesize

      4KB

    • memory/828-61-0x0000000000400000-0x00000000012C4000-memory.dmp

      Filesize

      14.8MB