3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866

Analysis

max time kernel
169s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 05:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe
Size

1.4MB
MD5

ada8fdd9e0f73a6dd70dccd1f5af531d
SHA1

c8643d18e1b844e08110bf73359973b61b36f3fa
SHA256

3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866
SHA512

ae2d348c1c70d73a1e198daf6011c8777396b3e1c96db7eb791be9c471e63baca95865405e6246a55a64a238c68a60030b12ca98b4cd937cdf1fccfe9bd08bc2
SSDEEP

24576:hrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8AL:hrBew72604doSw6ewM

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe

description	pid	process	target process
PID 4080 set thread context of 5016	4080	3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe	3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe

pid	process
5016	3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe
5016	3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe
5016	3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe
5016	3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe
5016	3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe

description	pid	process	target process
PID 4080 wrote to memory of 5016	4080	3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe	3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe
PID 4080 wrote to memory of 5016	4080	3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe	3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe
PID 4080 wrote to memory of 5016	4080	3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe	3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe
PID 4080 wrote to memory of 5016	4080	3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe	3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe
PID 4080 wrote to memory of 5016	4080	3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe	3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe
PID 4080 wrote to memory of 5016	4080	3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe	3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe
PID 4080 wrote to memory of 5016	4080	3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe	3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe
PID 4080 wrote to memory of 5016	4080	3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe	3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe
PID 4080 wrote to memory of 5016	4080	3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe	3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe
PID 4080 wrote to memory of 5016	4080	3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe	3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe

C:\Users\Admin\AppData\Local\Temp\3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe
"C:\Users\Admin\AppData\Local\Temp\3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Users\Admin\AppData\Local\Temp\3d44d2fa9b6baa6092f5ae724000091b26542913e843cb1896061ec6ea81f866.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5016-132-0x0000000000000000-mapping.dmp

Download
memory/5016-133-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/5016-134-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/5016-135-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/5016-136-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/5016-137-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download