Analysis
-
max time kernel
115s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2022 08:07
Static task
static1
Behavioral task
behavioral1
Sample
a26aa3ba363c7c4f0c0c235d833ad19cfad9a3f0a4e1f531a13c46e62a31647e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a26aa3ba363c7c4f0c0c235d833ad19cfad9a3f0a4e1f531a13c46e62a31647e.exe
Resource
win10v2004-20220812-en
General
-
Target
a26aa3ba363c7c4f0c0c235d833ad19cfad9a3f0a4e1f531a13c46e62a31647e.exe
-
Size
1.3MB
-
MD5
68499852e2ca0e9b26d6993282bd3561
-
SHA1
570ddbdcb08023cb810b7fa7f0a49f2e1d3d917b
-
SHA256
a26aa3ba363c7c4f0c0c235d833ad19cfad9a3f0a4e1f531a13c46e62a31647e
-
SHA512
0b704778f77570127dc1063521aa9d6b0d129cd90304ac3acd5194685274bafce38e117cacaa0dc4a205f19b1b1a0c16c039efbe6bce2d777afe1c47cebab630
-
SSDEEP
24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakPf:zrKo4ZwCOnYjVmJPaU
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3996 set thread context of 1764 3996 a26aa3ba363c7c4f0c0c235d833ad19cfad9a3f0a4e1f531a13c46e62a31647e.exe 79 -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1764 a26aa3ba363c7c4f0c0c235d833ad19cfad9a3f0a4e1f531a13c46e62a31647e.exe 1764 a26aa3ba363c7c4f0c0c235d833ad19cfad9a3f0a4e1f531a13c46e62a31647e.exe 1764 a26aa3ba363c7c4f0c0c235d833ad19cfad9a3f0a4e1f531a13c46e62a31647e.exe 1764 a26aa3ba363c7c4f0c0c235d833ad19cfad9a3f0a4e1f531a13c46e62a31647e.exe 1764 a26aa3ba363c7c4f0c0c235d833ad19cfad9a3f0a4e1f531a13c46e62a31647e.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3996 wrote to memory of 1764 3996 a26aa3ba363c7c4f0c0c235d833ad19cfad9a3f0a4e1f531a13c46e62a31647e.exe 79 PID 3996 wrote to memory of 1764 3996 a26aa3ba363c7c4f0c0c235d833ad19cfad9a3f0a4e1f531a13c46e62a31647e.exe 79 PID 3996 wrote to memory of 1764 3996 a26aa3ba363c7c4f0c0c235d833ad19cfad9a3f0a4e1f531a13c46e62a31647e.exe 79 PID 3996 wrote to memory of 1764 3996 a26aa3ba363c7c4f0c0c235d833ad19cfad9a3f0a4e1f531a13c46e62a31647e.exe 79 PID 3996 wrote to memory of 1764 3996 a26aa3ba363c7c4f0c0c235d833ad19cfad9a3f0a4e1f531a13c46e62a31647e.exe 79 PID 3996 wrote to memory of 1764 3996 a26aa3ba363c7c4f0c0c235d833ad19cfad9a3f0a4e1f531a13c46e62a31647e.exe 79 PID 3996 wrote to memory of 1764 3996 a26aa3ba363c7c4f0c0c235d833ad19cfad9a3f0a4e1f531a13c46e62a31647e.exe 79 PID 3996 wrote to memory of 1764 3996 a26aa3ba363c7c4f0c0c235d833ad19cfad9a3f0a4e1f531a13c46e62a31647e.exe 79 PID 3996 wrote to memory of 1764 3996 a26aa3ba363c7c4f0c0c235d833ad19cfad9a3f0a4e1f531a13c46e62a31647e.exe 79 PID 3996 wrote to memory of 1764 3996 a26aa3ba363c7c4f0c0c235d833ad19cfad9a3f0a4e1f531a13c46e62a31647e.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\a26aa3ba363c7c4f0c0c235d833ad19cfad9a3f0a4e1f531a13c46e62a31647e.exe"C:\Users\Admin\AppData\Local\Temp\a26aa3ba363c7c4f0c0c235d833ad19cfad9a3f0a4e1f531a13c46e62a31647e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\a26aa3ba363c7c4f0c0c235d833ad19cfad9a3f0a4e1f531a13c46e62a31647e.exe
- Suspicious use of SetWindowsHookEx
PID:1764
-