126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e

Analysis

max time kernel
90s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 05:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe
Size

1.4MB
MD5

648f9dd7fcf13025a0cde0c6be73eb3c
SHA1

3b944b49255a3172bbbfa400daa364786c29c966
SHA256

126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e
SHA512

dbe8aebcf43c90095353f191e51f6778960399365b46c2ea39b043858f95628c47a88e2b1c6f99e92ff17badb1a1f8058a0ff99e55905b6bddbd104b5559ba52
SSDEEP

24576:BrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8AZ:BrBew72604doSw6ewe

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe

description	pid	process	target process
PID 2692 set thread context of 2100	2692	126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe	126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe

pid	process
2100	126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe
2100	126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe
2100	126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe
2100	126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe
2100	126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe

description	pid	process	target process
PID 2692 wrote to memory of 2100	2692	126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe	126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe
PID 2692 wrote to memory of 2100	2692	126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe	126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe
PID 2692 wrote to memory of 2100	2692	126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe	126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe
PID 2692 wrote to memory of 2100	2692	126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe	126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe
PID 2692 wrote to memory of 2100	2692	126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe	126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe
PID 2692 wrote to memory of 2100	2692	126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe	126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe
PID 2692 wrote to memory of 2100	2692	126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe	126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe
PID 2692 wrote to memory of 2100	2692	126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe	126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe
PID 2692 wrote to memory of 2100	2692	126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe	126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe
PID 2692 wrote to memory of 2100	2692	126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe	126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe

C:\Users\Admin\AppData\Local\Temp\126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe
"C:\Users\Admin\AppData\Local\Temp\126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Users\Admin\AppData\Local\Temp\126cff0b99875a49a498885d058b7a67f2bd030e89e56be8d6e441fffaeec50e.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2100-132-0x0000000000000000-mapping.dmp

Download
memory/2100-133-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/2100-134-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/2100-135-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/2100-136-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/2100-137-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download