1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 05:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe
Size

1.4MB
MD5

cb8cd1d7304bf2cb9f5e23d5ae84658d
SHA1

9b1e5b1908ee56597d692351743f07161e310adc
SHA256

1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234
SHA512

3c851edcf7151637ac04eda7d3fce0006c7978f55dbe8d6785826ab352e18ceb860651945ed47aa8e320f7d7f3df334f6c2dd612fed0b3129379bff7a88e83f7
SSDEEP

24576:Qy83rXf95JRrVwk52X8DL2ZaVVk7FcAm6ycERLdDzUbBtEpZvj0j5K:Qy8hFykeu2ZykaAJyrRZYBtEt

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe

description	pid	process	target process
PID 4004 set thread context of 4876	4004	1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe	1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe

pid	process
4876	1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe
4876	1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe
4876	1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe
4876	1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe
4876	1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe

description	pid	process	target process
PID 4004 wrote to memory of 4876	4004	1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe	1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe
PID 4004 wrote to memory of 4876	4004	1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe	1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe
PID 4004 wrote to memory of 4876	4004	1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe	1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe
PID 4004 wrote to memory of 4876	4004	1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe	1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe
PID 4004 wrote to memory of 4876	4004	1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe	1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe
PID 4004 wrote to memory of 4876	4004	1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe	1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe
PID 4004 wrote to memory of 4876	4004	1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe	1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe
PID 4004 wrote to memory of 4876	4004	1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe	1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe
PID 4004 wrote to memory of 4876	4004	1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe	1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe
PID 4004 wrote to memory of 4876	4004	1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe	1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe

C:\Users\Admin\AppData\Local\Temp\1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe
"C:\Users\Admin\AppData\Local\Temp\1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Users\Admin\AppData\Local\Temp\1508f24768c752a0c6dea7105916ae2837b86bb1efaaccfbed3dc357ec87a234.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4876-132-0x0000000000000000-mapping.dmp

Download
memory/4876-133-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/4876-134-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/4876-135-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/4876-136-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/4876-137-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download