b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8

Analysis

max time kernel
91s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 06:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe
Size

1.1MB
MD5

1d2b44e5fceac227e22ac9ce00677cf4
SHA1

9beefd86595246c7eb75fabdb422d4ad2ee6f739
SHA256

b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8
SHA512

d9841efe09938f6e12e80e58cb429b716e990286253c59f6a2ba23011c9a1e44e285bb2783164961376939b05f64f0052c15a1274a22cf966febc997c0ad2028
SSDEEP

24576:yio2C4Tz86EE1by3swR9HrwNmojHuD/bsytUltKo+5+VYrle5s9:U4TzJJm9R9kFTSbNtkwo+5Vrle5E

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe

description	pid	process	target process
PID 4960 set thread context of 4656	4960	b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe	b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe

pid	process
4656	b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe
4656	b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe
4656	b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe
4656	b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe
4656	b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe

description	pid	process	target process
PID 4960 wrote to memory of 4656	4960	b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe	b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe
PID 4960 wrote to memory of 4656	4960	b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe	b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe
PID 4960 wrote to memory of 4656	4960	b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe	b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe
PID 4960 wrote to memory of 4656	4960	b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe	b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe
PID 4960 wrote to memory of 4656	4960	b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe	b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe
PID 4960 wrote to memory of 4656	4960	b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe	b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe
PID 4960 wrote to memory of 4656	4960	b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe	b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe
PID 4960 wrote to memory of 4656	4960	b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe	b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe
PID 4960 wrote to memory of 4656	4960	b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe	b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe
PID 4960 wrote to memory of 4656	4960	b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe	b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe

C:\Users\Admin\AppData\Local\Temp\b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe
"C:\Users\Admin\AppData\Local\Temp\b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4960

C:\Users\Admin\AppData\Local\Temp\b938238b99c43ab9bce8c7ecbeaf308c037fc4b985a9afafb51d88e7ec664ad8.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4656-135-0x0000000000000000-mapping.dmp

Download
memory/4656-136-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4656-137-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4656-138-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4656-139-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4656-140-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download