60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a

Analysis

max time kernel
130s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 06:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe
Size

1.1MB
MD5

5c8c2a8eb0f54da1a4f718aa938eb151
SHA1

fa8ae9265e5c54a1e98c4b9cf2b64c3a840ce5b0
SHA256

60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a
SHA512

19622d4ce80f0af074eb1ef3895ce8670e29bb7344ac4083da04c72b3066cf9880a55877384539a3e8ad52cf81b8e85ead0d95ce70c2e26f1980af8b1d200585
SSDEEP

24576:yio2C4Tz86EE1by3swR9HrwNmojHuD/bsytUltKo+5+VYrle5sx:U4TzJJm9R9kFTSbNtkwo+5Vrle5w

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe

description	pid	process	target process
PID 3336 set thread context of 4424	3336	60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe	60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe

pid	process
4424	60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe
4424	60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe
4424	60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe
4424	60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe
4424	60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe

description	pid	process	target process
PID 3336 wrote to memory of 4424	3336	60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe	60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe
PID 3336 wrote to memory of 4424	3336	60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe	60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe
PID 3336 wrote to memory of 4424	3336	60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe	60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe
PID 3336 wrote to memory of 4424	3336	60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe	60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe
PID 3336 wrote to memory of 4424	3336	60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe	60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe
PID 3336 wrote to memory of 4424	3336	60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe	60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe
PID 3336 wrote to memory of 4424	3336	60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe	60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe
PID 3336 wrote to memory of 4424	3336	60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe	60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe
PID 3336 wrote to memory of 4424	3336	60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe	60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe
PID 3336 wrote to memory of 4424	3336	60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe	60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe

C:\Users\Admin\AppData\Local\Temp\60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe
"C:\Users\Admin\AppData\Local\Temp\60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3336

C:\Users\Admin\AppData\Local\Temp\60ea634484bfd9096138dc4175d72163e682c41c4568819f17550602fae05d6a.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4424-132-0x0000000000000000-mapping.dmp

Download
memory/4424-134-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4424-133-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4424-135-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4424-136-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4424-137-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download