8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 06:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe
Size

1.1MB
MD5

1f81ced5d9b32e8371e399b317a932b7
SHA1

2096196a09ae6b9c7042e876320c9ea863d3ad8e
SHA256

8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626
SHA512

81a09d72c2ffffb6dd81e250dc1e210406523cf139ca99d5723f25d64d8b685493bf38bbb81449ce2fce21501cedd5dfa1a11ce14fbcd08f85535c42cb7cccc9
SSDEEP

24576:yio2C4Tz86EE1by3swR9HrwNmojHuD/bsytUltKo+5+VYrle5sv:U4TzJJm9R9kFTSbNtkwo+5Vrle5K

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe

description	pid	process	target process
PID 4256 set thread context of 4972	4256	8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe	8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe

pid	process
4972	8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe
4972	8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe
4972	8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe
4972	8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe
4972	8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe

description	pid	process	target process
PID 4256 wrote to memory of 4972	4256	8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe	8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe
PID 4256 wrote to memory of 4972	4256	8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe	8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe
PID 4256 wrote to memory of 4972	4256	8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe	8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe
PID 4256 wrote to memory of 4972	4256	8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe	8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe
PID 4256 wrote to memory of 4972	4256	8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe	8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe
PID 4256 wrote to memory of 4972	4256	8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe	8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe
PID 4256 wrote to memory of 4972	4256	8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe	8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe
PID 4256 wrote to memory of 4972	4256	8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe	8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe
PID 4256 wrote to memory of 4972	4256	8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe	8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe
PID 4256 wrote to memory of 4972	4256	8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe	8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe

C:\Users\Admin\AppData\Local\Temp\8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe
"C:\Users\Admin\AppData\Local\Temp\8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4256

C:\Users\Admin\AppData\Local\Temp\8632aa6e41e7779a9ac4f36c942e0dcf26328077f305306c980f02b763cb2626.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4972-132-0x0000000000000000-mapping.dmp

Download
memory/4972-133-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4972-134-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4972-135-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4972-136-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4972-137-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download