faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b

Analysis

max time kernel
132s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 06:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe
Size

1.1MB
MD5

93b6fd2b5604c1c4864125ba28060594
SHA1

b787cb7589411997d5bb0c7222474107bd7369fd
SHA256

faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b
SHA512

524175bfcc2f11851b337a8a9511434fcf533c2ee9c730ce9177ad64d422bf5bad951de855dc74034e132e1be04d09e9bcec5ff6075954d7d5dd6fc47c56e66f
SSDEEP

24576:iio2C4Tz86EE1by3swR9HrwNmojHuD/bsytUltKo+5+VYrle5st:k4TzJJm9R9kFTSbNtkwo+5Vrle50

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe

description	pid	process	target process
PID 4776 set thread context of 1428	4776	faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe	faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe

pid	process
1428	faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe
1428	faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe
1428	faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe
1428	faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe
1428	faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe

description	pid	process	target process
PID 4776 wrote to memory of 1428	4776	faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe	faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe
PID 4776 wrote to memory of 1428	4776	faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe	faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe
PID 4776 wrote to memory of 1428	4776	faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe	faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe
PID 4776 wrote to memory of 1428	4776	faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe	faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe
PID 4776 wrote to memory of 1428	4776	faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe	faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe
PID 4776 wrote to memory of 1428	4776	faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe	faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe
PID 4776 wrote to memory of 1428	4776	faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe	faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe
PID 4776 wrote to memory of 1428	4776	faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe	faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe
PID 4776 wrote to memory of 1428	4776	faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe	faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe
PID 4776 wrote to memory of 1428	4776	faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe	faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe

C:\Users\Admin\AppData\Local\Temp\faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe
"C:\Users\Admin\AppData\Local\Temp\faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4776

C:\Users\Admin\AppData\Local\Temp\faebdeea6e0d699152b61f6f2893df243ad8f53cd6b9ee54a3dea3c1c6a42c8b.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:1428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1428-132-0x0000000000000000-mapping.dmp

Download
memory/1428-133-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1428-134-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1428-135-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1428-136-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1428-137-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download