fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 06:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe
Size

1.1MB
MD5

84dc5a4feeb811809049dbe1299c0fa1
SHA1

b3160bc2c1c911ba169205420f018f9dd4946fbd
SHA256

fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657
SHA512

1df0db1510337120018f2e68c6a92c4b65110c8180c42934beff481a60380b5c220c4162313f95d585b30cafce6c4bded4573244faddf4f791a516f18b6302a5
SSDEEP

24576:yio2C4Tz86EE1by3swR9HrwNmojHuD/bsytUltKo+5+VYrle5sC:U4TzJJm9R9kFTSbNtkwo+5Vrle5L

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe

description	pid	process	target process
PID 2416 set thread context of 3436	2416	fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe	fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe

pid	process
3436	fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe
3436	fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe
3436	fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe
3436	fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe
3436	fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe

description	pid	process	target process
PID 2416 wrote to memory of 3436	2416	fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe	fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe
PID 2416 wrote to memory of 3436	2416	fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe	fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe
PID 2416 wrote to memory of 3436	2416	fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe	fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe
PID 2416 wrote to memory of 3436	2416	fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe	fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe
PID 2416 wrote to memory of 3436	2416	fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe	fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe
PID 2416 wrote to memory of 3436	2416	fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe	fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe
PID 2416 wrote to memory of 3436	2416	fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe	fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe
PID 2416 wrote to memory of 3436	2416	fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe	fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe
PID 2416 wrote to memory of 3436	2416	fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe	fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe
PID 2416 wrote to memory of 3436	2416	fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe	fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe

C:\Users\Admin\AppData\Local\Temp\fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe
"C:\Users\Admin\AppData\Local\Temp\fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2416

C:\Users\Admin\AppData\Local\Temp\fff09a3ae64a42aeeee4da6d36751dff74972c7b95f3a2e345f836f3650c5657.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:3436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3436-132-0x0000000000000000-mapping.dmp

Download
memory/3436-134-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/3436-133-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/3436-135-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/3436-136-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/3436-137-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download