0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 05:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe
Size

1.4MB
MD5

f2da130639a4dd6ff7cda5637ca1b5b8
SHA1

a0b73d6c80a4e2000ebd0911785d33777bbd69c7
SHA256

0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215
SHA512

6bbf98cf0c94c7ca2614b4c0865dd9da3c3c6c6418778d4f6b91a0e30cbd65b580c8a64a539f6fef33a6c6f05142261705b0d16be60c2e32f37691c704f0ae30
SSDEEP

24576:hrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8Abb:hrBew72604doSw6ewA

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe

description	pid	process	target process
PID 4596 set thread context of 3592	4596	0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe	0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe

pid	process
3592	0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe
3592	0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe
3592	0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe
3592	0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe
3592	0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe

description	pid	process	target process
PID 4596 wrote to memory of 3592	4596	0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe	0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe
PID 4596 wrote to memory of 3592	4596	0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe	0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe
PID 4596 wrote to memory of 3592	4596	0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe	0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe
PID 4596 wrote to memory of 3592	4596	0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe	0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe
PID 4596 wrote to memory of 3592	4596	0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe	0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe
PID 4596 wrote to memory of 3592	4596	0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe	0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe
PID 4596 wrote to memory of 3592	4596	0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe	0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe
PID 4596 wrote to memory of 3592	4596	0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe	0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe
PID 4596 wrote to memory of 3592	4596	0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe	0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe
PID 4596 wrote to memory of 3592	4596	0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe	0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe

C:\Users\Admin\AppData\Local\Temp\0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe
"C:\Users\Admin\AppData\Local\Temp\0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Users\Admin\AppData\Local\Temp\0d08b1ced69a9f4380cd221998636f8dd216887eee4bcb18dedcba5589b22215.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3592-132-0x0000000000000000-mapping.dmp

Download
memory/3592-134-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3592-133-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3592-135-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3592-136-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3592-137-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download