1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330

Analysis

max time kernel
139s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe
Size

1.1MB
MD5

6f5cd93a69889d70775b9f77e88f12f3
SHA1

040f98973567341eb4918aea740052b2f43bc944
SHA256

1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330
SHA512

48b59adc3435bbac1dbc2125c7c44cf6e320dcec173e6923e9a2e6e1836bb9e415083291992f5f8d38d66a78acadbad748042b208a5ea224d5612c31bd057a57
SSDEEP

24576:iio2C4Tz86EE1by3swR9HrwNmojHuD/bsytUltKo+5+VYrle5sd:k4TzJJm9R9kFTSbNtkwo+5Vrle5o

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe

description	pid	process	target process
PID 2416 set thread context of 4248	2416	1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe	1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe

pid	process
4248	1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe
4248	1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe
4248	1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe
4248	1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe
4248	1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe

description	pid	process	target process
PID 2416 wrote to memory of 4248	2416	1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe	1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe
PID 2416 wrote to memory of 4248	2416	1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe	1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe
PID 2416 wrote to memory of 4248	2416	1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe	1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe
PID 2416 wrote to memory of 4248	2416	1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe	1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe
PID 2416 wrote to memory of 4248	2416	1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe	1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe
PID 2416 wrote to memory of 4248	2416	1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe	1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe
PID 2416 wrote to memory of 4248	2416	1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe	1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe
PID 2416 wrote to memory of 4248	2416	1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe	1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe
PID 2416 wrote to memory of 4248	2416	1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe	1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe
PID 2416 wrote to memory of 4248	2416	1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe	1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe

C:\Users\Admin\AppData\Local\Temp\1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe
"C:\Users\Admin\AppData\Local\Temp\1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2416

C:\Users\Admin\AppData\Local\Temp\1dc973a47ce16e39fac264e10a95e821f16c0e0c4798166558d0fd90dc97c330.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4248-132-0x0000000000000000-mapping.dmp

Download
memory/4248-133-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4248-134-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4248-135-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4248-136-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4248-137-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download