42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6

Analysis

max time kernel
150s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 06:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe
Size

1.1MB
MD5

7c5544fc29d73d8cd6050c994cfc4575
SHA1

7daaf31ce5771426442645af3ae1467796c30b65
SHA256

42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6
SHA512

799ab4e54cd7486a7f382052dafdc4dd291565ff5613f8839777b449b6aaf2da84488a1ac043c8fa73fbc688f032e7a66015ea79c86ec5c304c34a43a6c95c7a
SSDEEP

24576:yio2C4Tz86EE1by3swR9HrwNmojHuD/bsytUltKo+5+VYrle5sy:U4TzJJm9R9kFTSbNtkwo+5Vrle53

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe

description	pid	process	target process
PID 5016 set thread context of 4584	5016	42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe	42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe

pid	process
4584	42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe
4584	42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe
4584	42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe
4584	42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe
4584	42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe

description	pid	process	target process
PID 5016 wrote to memory of 4584	5016	42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe	42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe
PID 5016 wrote to memory of 4584	5016	42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe	42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe
PID 5016 wrote to memory of 4584	5016	42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe	42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe
PID 5016 wrote to memory of 4584	5016	42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe	42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe
PID 5016 wrote to memory of 4584	5016	42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe	42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe
PID 5016 wrote to memory of 4584	5016	42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe	42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe
PID 5016 wrote to memory of 4584	5016	42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe	42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe
PID 5016 wrote to memory of 4584	5016	42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe	42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe
PID 5016 wrote to memory of 4584	5016	42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe	42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe
PID 5016 wrote to memory of 4584	5016	42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe	42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe

C:\Users\Admin\AppData\Local\Temp\42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe
"C:\Users\Admin\AppData\Local\Temp\42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5016

C:\Users\Admin\AppData\Local\Temp\42c310f58d4c483fef19e400abfe2d4a0ca57ae409f36829f79edaaa0795c4e6.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4584-132-0x0000000000000000-mapping.dmp

Download
memory/4584-133-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4584-134-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4584-135-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4584-136-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4584-137-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download