Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 06:33
Static task
static1
Behavioral task
behavioral1
Sample
712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe
Resource
win10v2004-20220812-en
General
-
Target
712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe
-
Size
1.1MB
-
MD5
b7efb1177065edd61b79ea5d912a0945
-
SHA1
4c7b4f2ccc845bc9e3ba869c153038c5f01af249
-
SHA256
712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f
-
SHA512
ddc86ef0f50065f9db53472b7149daa631f28efbb8cc434fcb63b1d613dabaf15c2bcdb1c5f81ed55fd60107296ac2298652f36f1fd939fb833541f12a544b11
-
SSDEEP
24576:iio2C4Tz86EE1by3swR9HrwNmojHuD/bsytUltKo+5+VYrle5sw:k4TzJJm9R9kFTSbNtkwo+5Vrle5B
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exedescription pid process target process PID 4656 set thread context of 544 4656 712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe 712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exepid process 544 712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe 544 712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe 544 712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe 544 712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe 544 712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exedescription pid process target process PID 4656 wrote to memory of 544 4656 712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe 712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe PID 4656 wrote to memory of 544 4656 712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe 712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe PID 4656 wrote to memory of 544 4656 712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe 712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe PID 4656 wrote to memory of 544 4656 712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe 712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe PID 4656 wrote to memory of 544 4656 712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe 712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe PID 4656 wrote to memory of 544 4656 712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe 712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe PID 4656 wrote to memory of 544 4656 712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe 712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe PID 4656 wrote to memory of 544 4656 712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe 712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe PID 4656 wrote to memory of 544 4656 712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe 712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe PID 4656 wrote to memory of 544 4656 712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe 712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe"C:\Users\Admin\AppData\Local\Temp\712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\712b71f3f9360ef6c00cad40c09708737670be4489ef7763d867d929ec235b3f.exe
- Suspicious use of SetWindowsHookEx
PID:544