Analysis
-
max time kernel
184s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2022 07:53
Static task
static1
Behavioral task
behavioral1
Sample
a694be8a621c06d0ddf50cacd6ea1112caee36e7b5251e115bd24f48da0a6033.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a694be8a621c06d0ddf50cacd6ea1112caee36e7b5251e115bd24f48da0a6033.exe
Resource
win10v2004-20221111-en
General
-
Target
a694be8a621c06d0ddf50cacd6ea1112caee36e7b5251e115bd24f48da0a6033.exe
-
Size
1.3MB
-
MD5
917d65eb42d1678ef4a0cfdc3f2e8382
-
SHA1
1467df93de9a2f6f1201c3bab3aa873ca29f858c
-
SHA256
a694be8a621c06d0ddf50cacd6ea1112caee36e7b5251e115bd24f48da0a6033
-
SHA512
8b4e191e225b63cfa96fe26f83d36c462396d03e39ed73100d75b5387294ae06c1464f257684e6bd30cc03f2b5852607ef82090993191b38ee5302c22178db23
-
SSDEEP
24576:eDASdSysJOcj0VQpWbl7s2LP0CXuiAayiWASALUgv2j6R6XEVeRs9HgVfg43:BSQtk2zQytkgis6yx53
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2980 set thread context of 2168 2980 a694be8a621c06d0ddf50cacd6ea1112caee36e7b5251e115bd24f48da0a6033.exe 86 -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2168 a694be8a621c06d0ddf50cacd6ea1112caee36e7b5251e115bd24f48da0a6033.exe 2168 a694be8a621c06d0ddf50cacd6ea1112caee36e7b5251e115bd24f48da0a6033.exe 2168 a694be8a621c06d0ddf50cacd6ea1112caee36e7b5251e115bd24f48da0a6033.exe 2168 a694be8a621c06d0ddf50cacd6ea1112caee36e7b5251e115bd24f48da0a6033.exe 2168 a694be8a621c06d0ddf50cacd6ea1112caee36e7b5251e115bd24f48da0a6033.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2980 wrote to memory of 2168 2980 a694be8a621c06d0ddf50cacd6ea1112caee36e7b5251e115bd24f48da0a6033.exe 86 PID 2980 wrote to memory of 2168 2980 a694be8a621c06d0ddf50cacd6ea1112caee36e7b5251e115bd24f48da0a6033.exe 86 PID 2980 wrote to memory of 2168 2980 a694be8a621c06d0ddf50cacd6ea1112caee36e7b5251e115bd24f48da0a6033.exe 86 PID 2980 wrote to memory of 2168 2980 a694be8a621c06d0ddf50cacd6ea1112caee36e7b5251e115bd24f48da0a6033.exe 86 PID 2980 wrote to memory of 2168 2980 a694be8a621c06d0ddf50cacd6ea1112caee36e7b5251e115bd24f48da0a6033.exe 86 PID 2980 wrote to memory of 2168 2980 a694be8a621c06d0ddf50cacd6ea1112caee36e7b5251e115bd24f48da0a6033.exe 86 PID 2980 wrote to memory of 2168 2980 a694be8a621c06d0ddf50cacd6ea1112caee36e7b5251e115bd24f48da0a6033.exe 86 PID 2980 wrote to memory of 2168 2980 a694be8a621c06d0ddf50cacd6ea1112caee36e7b5251e115bd24f48da0a6033.exe 86 PID 2980 wrote to memory of 2168 2980 a694be8a621c06d0ddf50cacd6ea1112caee36e7b5251e115bd24f48da0a6033.exe 86 PID 2980 wrote to memory of 2168 2980 a694be8a621c06d0ddf50cacd6ea1112caee36e7b5251e115bd24f48da0a6033.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\a694be8a621c06d0ddf50cacd6ea1112caee36e7b5251e115bd24f48da0a6033.exe"C:\Users\Admin\AppData\Local\Temp\a694be8a621c06d0ddf50cacd6ea1112caee36e7b5251e115bd24f48da0a6033.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\a694be8a621c06d0ddf50cacd6ea1112caee36e7b5251e115bd24f48da0a6033.exe
- Suspicious use of SetWindowsHookEx
PID:2168
-