33ea937a0a5f1c3cd1d4c475a5d8442374ab9cb825ea929d3335cdba8138198b

Analysis

max time kernel
121s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-12-2023 22:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcf556f0b11f47d9f215528fe6d98cf1.exe
Size

478KB
MD5

fcf556f0b11f47d9f215528fe6d98cf1
SHA1

ce334dcf2f5daf3de5da02188b58b222a130dbc4
SHA256

33ea937a0a5f1c3cd1d4c475a5d8442374ab9cb825ea929d3335cdba8138198b
SHA512

668dd9d5356208e2d511b30c24fcff85da8de41330ad1c3f2a0edc466c15e6a9508f56192d312e152ef57aede2388a82cf2c95e9e7a5c14f36af15f162cc6466
SSDEEP

12288:0euKz5I1qHhwlWoflw5DzbUv+a4oQR6M7:jnVI1qBwl9fIzbsQLIQ

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2896 set thread context of 2744	2896	fcf556f0b11f47d9f215528fe6d98cf1.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2744	fcf556f0b11f47d9f215528fe6d98cf1.exe
2744	fcf556f0b11f47d9f215528fe6d98cf1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2896	fcf556f0b11f47d9f215528fe6d98cf1.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2744	2896	fcf556f0b11f47d9f215528fe6d98cf1.exe	28
PID 2896 wrote to memory of 2744	2896	fcf556f0b11f47d9f215528fe6d98cf1.exe	28
PID 2896 wrote to memory of 2744	2896	fcf556f0b11f47d9f215528fe6d98cf1.exe	28
PID 2896 wrote to memory of 2744	2896	fcf556f0b11f47d9f215528fe6d98cf1.exe	28
PID 2896 wrote to memory of 2744	2896	fcf556f0b11f47d9f215528fe6d98cf1.exe	28
PID 2896 wrote to memory of 2744	2896	fcf556f0b11f47d9f215528fe6d98cf1.exe	28
PID 2896 wrote to memory of 2744	2896	fcf556f0b11f47d9f215528fe6d98cf1.exe	28
PID 2896 wrote to memory of 2744	2896	fcf556f0b11f47d9f215528fe6d98cf1.exe	28
PID 2744 wrote to memory of 1312	2744	fcf556f0b11f47d9f215528fe6d98cf1.exe	18
PID 2744 wrote to memory of 1312	2744	fcf556f0b11f47d9f215528fe6d98cf1.exe	18
PID 2744 wrote to memory of 1312	2744	fcf556f0b11f47d9f215528fe6d98cf1.exe	18
PID 2744 wrote to memory of 1312	2744	fcf556f0b11f47d9f215528fe6d98cf1.exe	18

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1312
- C:\Users\Admin\AppData\Local\Temp\fcf556f0b11f47d9f215528fe6d98cf1.exe
  "C:\Users\Admin\AppData\Local\Temp\fcf556f0b11f47d9f215528fe6d98cf1.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Users\Admin\AppData\Local\Temp\fcf556f0b11f47d9f215528fe6d98cf1.exe
    C:\Users\Admin\AppData\Local\Temp\fcf556f0b11f47d9f215528fe6d98cf1.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1312-26-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1312-22-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/2744-19-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2744-36-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2744-25-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2744-16-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2744-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2744-17-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2896-18-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2896-3-0x0000000001E30000-0x0000000001E40000-memory.dmp

Filesize
64KB

Download
memory/2896-20-0x0000000000260000-0x00000000002AE000-memory.dmp

Filesize
312KB

Download
memory/2896-11-0x00000000002E0000-0x00000000002F0000-memory.dmp

Filesize
64KB

Download
memory/2896-10-0x0000000002100000-0x0000000002200000-memory.dmp

Filesize
1024KB

Download
memory/2896-9-0x0000000001E20000-0x0000000001E30000-memory.dmp

Filesize
64KB

Download
memory/2896-8-0x00000000002E0000-0x00000000002F0000-memory.dmp

Filesize
64KB

Download
memory/2896-21-0x0000000075AC0000-0x0000000075BD0000-memory.dmp

Filesize
1.1MB

Download
memory/2896-2-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2896-1-0x0000000000260000-0x00000000002AE000-memory.dmp

Filesize
312KB

Download
memory/2896-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2896-4-0x0000000077E30000-0x0000000077E31000-memory.dmp

Filesize
4KB

Download
memory/2896-14-0x0000000001E40000-0x0000000001F40000-memory.dmp

Filesize
1024KB

Download
memory/2896-12-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2896-6-0x0000000075AC0000-0x0000000075BD0000-memory.dmp

Filesize
1.1MB

Download