251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 06:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe
Size

1.1MB
MD5

f6de550ee7274d06b38b762ce6845f73
SHA1

ef7f001b74d61767b618b7ede6877897edd89203
SHA256

251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0
SHA512

d4615a0a64f9006d37511eac4dc30f485a9b37c01add7bfb5369874b0500fd846c80e924e2e234a2380495df60433f7d2e6b86d7b61edfc10124f4bcd0caba88
SSDEEP

24576:iio2C4Tz86EE1by3swR9HrwNmojHuD/bsytUltKo+5+VYrle5st:k4TzJJm9R9kFTSbNtkwo+5Vrle5c

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe

description	pid	process	target process
PID 4808 set thread context of 4512	4808	251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe	251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe

pid	process
4512	251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe
4512	251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe
4512	251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe
4512	251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe
4512	251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe

description	pid	process	target process
PID 4808 wrote to memory of 4512	4808	251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe	251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe
PID 4808 wrote to memory of 4512	4808	251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe	251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe
PID 4808 wrote to memory of 4512	4808	251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe	251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe
PID 4808 wrote to memory of 4512	4808	251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe	251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe
PID 4808 wrote to memory of 4512	4808	251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe	251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe
PID 4808 wrote to memory of 4512	4808	251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe	251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe
PID 4808 wrote to memory of 4512	4808	251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe	251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe
PID 4808 wrote to memory of 4512	4808	251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe	251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe
PID 4808 wrote to memory of 4512	4808	251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe	251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe
PID 4808 wrote to memory of 4512	4808	251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe	251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe

C:\Users\Admin\AppData\Local\Temp\251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe
"C:\Users\Admin\AppData\Local\Temp\251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4808

C:\Users\Admin\AppData\Local\Temp\251a418a25e53b25d59b5176441e2fefeae45b9e21b92e39c6e9d0897be050a0.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4512-132-0x0000000000000000-mapping.dmp

Download
memory/4512-134-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4512-133-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4512-135-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4512-136-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4512-137-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download