df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e

Analysis

max time kernel
139s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 06:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe
Size

1.1MB
MD5

b2e75e5447434a13ae196ef7de0a4199
SHA1

0f700db13948689edb62df984abdebb0c85023ad
SHA256

df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e
SHA512

42e39a7693f1d53a6bffb3689c566f1a3beed7b229c0c25f67ca37f2395814809bbb6bbc45aa221b984b5bf5855d65bbaed86914d8a2f80d984e73fb8c9b8373
SSDEEP

24576:yio2C4Tz86EE1by3swR9HrwNmojHuD/bsytUltKo+5+VYrle5s6:U4TzJJm9R9kFTSbNtkwo+5Vrle5H

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe

description	pid	process	target process
PID 5116 set thread context of 2756	5116	df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe	df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe

pid	process
2756	df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe
2756	df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe
2756	df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe
2756	df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe
2756	df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe

description	pid	process	target process
PID 5116 wrote to memory of 2756	5116	df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe	df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe
PID 5116 wrote to memory of 2756	5116	df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe	df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe
PID 5116 wrote to memory of 2756	5116	df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe	df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe
PID 5116 wrote to memory of 2756	5116	df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe	df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe
PID 5116 wrote to memory of 2756	5116	df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe	df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe
PID 5116 wrote to memory of 2756	5116	df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe	df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe
PID 5116 wrote to memory of 2756	5116	df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe	df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe
PID 5116 wrote to memory of 2756	5116	df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe	df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe
PID 5116 wrote to memory of 2756	5116	df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe	df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe
PID 5116 wrote to memory of 2756	5116	df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe	df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe

C:\Users\Admin\AppData\Local\Temp\df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe
"C:\Users\Admin\AppData\Local\Temp\df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5116

C:\Users\Admin\AppData\Local\Temp\df108c4a24e3f3b9b36950956d080a5ff1796962cf30165ae82dd0b3f105513e.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:2756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2756-132-0x0000000000000000-mapping.dmp

Download
memory/2756-134-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2756-133-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2756-135-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2756-136-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2756-137-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download