49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b

Analysis

max time kernel
181s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 06:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe
Size

1.1MB
MD5

03ff9a43222763b5341210fe0f7e7349
SHA1

eccc95d4493f4e86e70c2b5832011a19d1bdb873
SHA256

49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b
SHA512

6a4bc60c9bb411490829331d2d0ccda491b36c6c5b231673f2d700b9c70980479069e3022a06cf35a588339a47e7788311c0eba33b098cff86abc4b6ce4d5fee
SSDEEP

24576:FiEpT/UOYXYGifoZHO6m6WSq06cDypII5d0/:B5j3IZuU60nCIIY/

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe

description	pid	process	target process
PID 2948 set thread context of 3472	2948	49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe	49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe

pid	process
3472	49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe
3472	49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe
3472	49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe
3472	49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe
3472	49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe

description	pid	process	target process
PID 2948 wrote to memory of 3472	2948	49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe	49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe
PID 2948 wrote to memory of 3472	2948	49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe	49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe
PID 2948 wrote to memory of 3472	2948	49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe	49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe
PID 2948 wrote to memory of 3472	2948	49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe	49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe
PID 2948 wrote to memory of 3472	2948	49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe	49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe
PID 2948 wrote to memory of 3472	2948	49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe	49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe
PID 2948 wrote to memory of 3472	2948	49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe	49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe
PID 2948 wrote to memory of 3472	2948	49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe	49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe
PID 2948 wrote to memory of 3472	2948	49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe	49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe
PID 2948 wrote to memory of 3472	2948	49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe	49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe

C:\Users\Admin\AppData\Local\Temp\49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe
"C:\Users\Admin\AppData\Local\Temp\49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2948

C:\Users\Admin\AppData\Local\Temp\49fbb96ebcca891d0b88226c1ac0e4a7b2b24ceb9788b451b334b683ddbafb5b.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:3472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3472-132-0x0000000000000000-mapping.dmp

Download
memory/3472-133-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/3472-134-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/3472-135-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/3472-136-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/3472-137-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download