89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f

Analysis

max time kernel
91s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 06:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe
Size

1.1MB
MD5

d593725c0b5d8c3149ed474befce5642
SHA1

9b5149d302b33fa2ef916b89b13fda773932ab05
SHA256

89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f
SHA512

8b0018d4de3e42311eb5121e094596f122b341c90b67413cf75e9ca30305346b8ffa3328eed91276dfe1d30882c66b3e5417955b4e62f54c9ffd31ef1d425aa2
SSDEEP

24576:iio2C4Tz86EE1by3swR9HrwNmojHuD/bsytUltKo+5+VYrle5s6:k4TzJJm9R9kFTSbNtkwo+5Vrle5D

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe

description	pid	process	target process
PID 4788 set thread context of 4300	4788	89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe	89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe

pid	process
4300	89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe
4300	89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe
4300	89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe
4300	89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe
4300	89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe

description	pid	process	target process
PID 4788 wrote to memory of 4300	4788	89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe	89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe
PID 4788 wrote to memory of 4300	4788	89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe	89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe
PID 4788 wrote to memory of 4300	4788	89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe	89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe
PID 4788 wrote to memory of 4300	4788	89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe	89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe
PID 4788 wrote to memory of 4300	4788	89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe	89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe
PID 4788 wrote to memory of 4300	4788	89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe	89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe
PID 4788 wrote to memory of 4300	4788	89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe	89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe
PID 4788 wrote to memory of 4300	4788	89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe	89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe
PID 4788 wrote to memory of 4300	4788	89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe	89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe
PID 4788 wrote to memory of 4300	4788	89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe	89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe

C:\Users\Admin\AppData\Local\Temp\89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe
"C:\Users\Admin\AppData\Local\Temp\89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4788

C:\Users\Admin\AppData\Local\Temp\89ace653997b2b3f14c870e4f2d2de7f9f659f9ac96f08410c9ff3f0d4b1d32f.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4300-132-0x0000000000000000-mapping.dmp

Download
memory/4300-133-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4300-134-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4300-135-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4300-136-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4300-137-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download