00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479

Analysis

max time kernel
106s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe
Size

1.4MB
MD5

ed936d4909232b7a496953d063d1cfca
SHA1

b09f69bb2a624e22f279077766adb9408827a2bd
SHA256

00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479
SHA512

836f4ccf525b635f92be803a276b94c074af532b553dfd8e3fd01f6e3915a9742ea930c0025c98001665c84d012ef1f7544df9538705cfd32e4f68a036965b8c
SSDEEP

24576:RrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8Aw:RrBew72604doSw6ew/

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe

description	pid	process	target process
PID 1592 set thread context of 1496	1592	00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe	00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe

pid	process
1496	00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe
1496	00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe
1496	00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe
1496	00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe
1496	00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe

description	pid	process	target process
PID 1592 wrote to memory of 1496	1592	00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe	00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe
PID 1592 wrote to memory of 1496	1592	00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe	00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe
PID 1592 wrote to memory of 1496	1592	00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe	00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe
PID 1592 wrote to memory of 1496	1592	00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe	00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe
PID 1592 wrote to memory of 1496	1592	00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe	00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe
PID 1592 wrote to memory of 1496	1592	00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe	00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe
PID 1592 wrote to memory of 1496	1592	00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe	00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe
PID 1592 wrote to memory of 1496	1592	00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe	00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe
PID 1592 wrote to memory of 1496	1592	00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe	00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe
PID 1592 wrote to memory of 1496	1592	00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe	00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe

C:\Users\Admin\AppData\Local\Temp\00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe
"C:\Users\Admin\AppData\Local\Temp\00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1592

C:\Users\Admin\AppData\Local\Temp\00f6a365002c538e4111005dbe7ad2f0cef69ddfead71512dc8a458728c93479.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:1496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1496-132-0x0000000000000000-mapping.dmp

Download
memory/1496-133-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1496-134-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1496-135-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1496-136-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1496-137-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1496-138-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download