Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2022 03:57
Static task
static1
Behavioral task
behavioral1
Sample
e8e236a24826867170847bf696243a2a2a9e46502d9979e51088ffcfff954f52.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e8e236a24826867170847bf696243a2a2a9e46502d9979e51088ffcfff954f52.exe
Resource
win10v2004-20220812-en
General
-
Target
e8e236a24826867170847bf696243a2a2a9e46502d9979e51088ffcfff954f52.exe
-
Size
1.3MB
-
MD5
006c887b9bb6bce150a787f5842fb37f
-
SHA1
2e90c34a81f51ba9af4098f481588425952e4e81
-
SHA256
e8e236a24826867170847bf696243a2a2a9e46502d9979e51088ffcfff954f52
-
SHA512
ef3f44db400d16b12596082086569ef47b0dfaf3df61245a0051015380b0d9b79fb446aa6adf2dd990df2af05d974400c60ce984ebf80b3a23be3832570c24ad
-
SSDEEP
24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakb:jrKo4ZwCOnYjVmJPaY
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1476 set thread context of 1276 1476 e8e236a24826867170847bf696243a2a2a9e46502d9979e51088ffcfff954f52.exe 79 -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1276 e8e236a24826867170847bf696243a2a2a9e46502d9979e51088ffcfff954f52.exe 1276 e8e236a24826867170847bf696243a2a2a9e46502d9979e51088ffcfff954f52.exe 1276 e8e236a24826867170847bf696243a2a2a9e46502d9979e51088ffcfff954f52.exe 1276 e8e236a24826867170847bf696243a2a2a9e46502d9979e51088ffcfff954f52.exe 1276 e8e236a24826867170847bf696243a2a2a9e46502d9979e51088ffcfff954f52.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1476 wrote to memory of 1276 1476 e8e236a24826867170847bf696243a2a2a9e46502d9979e51088ffcfff954f52.exe 79 PID 1476 wrote to memory of 1276 1476 e8e236a24826867170847bf696243a2a2a9e46502d9979e51088ffcfff954f52.exe 79 PID 1476 wrote to memory of 1276 1476 e8e236a24826867170847bf696243a2a2a9e46502d9979e51088ffcfff954f52.exe 79 PID 1476 wrote to memory of 1276 1476 e8e236a24826867170847bf696243a2a2a9e46502d9979e51088ffcfff954f52.exe 79 PID 1476 wrote to memory of 1276 1476 e8e236a24826867170847bf696243a2a2a9e46502d9979e51088ffcfff954f52.exe 79 PID 1476 wrote to memory of 1276 1476 e8e236a24826867170847bf696243a2a2a9e46502d9979e51088ffcfff954f52.exe 79 PID 1476 wrote to memory of 1276 1476 e8e236a24826867170847bf696243a2a2a9e46502d9979e51088ffcfff954f52.exe 79 PID 1476 wrote to memory of 1276 1476 e8e236a24826867170847bf696243a2a2a9e46502d9979e51088ffcfff954f52.exe 79 PID 1476 wrote to memory of 1276 1476 e8e236a24826867170847bf696243a2a2a9e46502d9979e51088ffcfff954f52.exe 79 PID 1476 wrote to memory of 1276 1476 e8e236a24826867170847bf696243a2a2a9e46502d9979e51088ffcfff954f52.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8e236a24826867170847bf696243a2a2a9e46502d9979e51088ffcfff954f52.exe"C:\Users\Admin\AppData\Local\Temp\e8e236a24826867170847bf696243a2a2a9e46502d9979e51088ffcfff954f52.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\e8e236a24826867170847bf696243a2a2a9e46502d9979e51088ffcfff954f52.exe
- Suspicious use of SetWindowsHookEx
PID:1276
-