eae7a2af4acb6615dc6aa9c89e880a693754c67b8a18eda582b98b1fd2504359

Analysis

max time kernel
91s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 17:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eae7a2af4acb6615dc6aa9c89e880a693754c67b8a18eda582b98b1fd2504359.exe
Size 646KB
Sample221011-v2h2qafed7
SHA256 eae7a2af4acb6615dc6aa9c89e880a693754c67b8a18eda582b98b1fd2504359
MD5 4666cee45d49973a85c21750dd648120
SHA1 a3192d229bc12162f101522c3bcbece05fb1885d
SHA512 f0a9f5e9ab2b29ef90c23a1b69e552db30d58d15340d8bc004c128def33cee7d5b2a71fd0dd2b000146487bf27bad18e3c0904528fab2c3586b7c356bd61c0d8
SSDEEP 12288:4g/Gf8ZN20F5wiyngf2gdTfdO6j1OIrvFZTs8VFIRfaMe:VZN20Cgiu1XXs8VFI0
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1684	eae7a2af4acb6615dc6aa9c89e880a693754c67b8a18eda582b98b1fd2504359.exe
4872	eae7a2af4acb6615dc6aa9c89e880a693754c67b8a18eda582b98b1fd2504359.exe
4932	eae7a2af4acb6615dc6aa9c89e880a693754c67b8a18eda582b98b1fd2504359.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 4872	1684	eae7a2af4acb6615dc6aa9c89e880a693754c67b8a18eda582b98b1fd2504359.exe	81
PID 1684 wrote to memory of 4872	1684	eae7a2af4acb6615dc6aa9c89e880a693754c67b8a18eda582b98b1fd2504359.exe	81
PID 1684 wrote to memory of 4872	1684	eae7a2af4acb6615dc6aa9c89e880a693754c67b8a18eda582b98b1fd2504359.exe	81
PID 1684 wrote to memory of 4932	1684	eae7a2af4acb6615dc6aa9c89e880a693754c67b8a18eda582b98b1fd2504359.exe	82
PID 1684 wrote to memory of 4932	1684	eae7a2af4acb6615dc6aa9c89e880a693754c67b8a18eda582b98b1fd2504359.exe	82
PID 1684 wrote to memory of 4932	1684	eae7a2af4acb6615dc6aa9c89e880a693754c67b8a18eda582b98b1fd2504359.exe	82

C:\Users\Admin\AppData\Local\Temp\eae7a2af4acb6615dc6aa9c89e880a693754c67b8a18eda582b98b1fd2504359.exe
"C:\Users\Admin\AppData\Local\Temp\eae7a2af4acb6615dc6aa9c89e880a693754c67b8a18eda582b98b1fd2504359.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Users\Admin\AppData\Local\Temp\eae7a2af4acb6615dc6aa9c89e880a693754c67b8a18eda582b98b1fd2504359.exe
  start
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4872
- C:\Users\Admin\AppData\Local\Temp\eae7a2af4acb6615dc6aa9c89e880a693754c67b8a18eda582b98b1fd2504359.exe
  watch
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1684-132-0x0000000000400000-0x00000000004A7000-memory.dmp

Download

memory/1684-133-0x0000000000400000-0x00000000004A7000-memory.dmp

Download

memory/1684-136-0x0000000000400000-0x00000000004A7000-memory.dmp

Download

memory/4872-137-0x0000000000400000-0x00000000004A7000-memory.dmp

Download

memory/4872-139-0x0000000000400000-0x00000000004A7000-memory.dmp

Download

memory/4872-141-0x0000000000400000-0x00000000004A7000-memory.dmp

Download

memory/4932-138-0x0000000000400000-0x00000000004A7000-memory.dmp

Download

memory/4932-140-0x0000000000400000-0x00000000004A7000-memory.dmp

Download

memory/4932-142-0x0000000000400000-0x00000000004A7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads