02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 06:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe
Size

1.1MB
MD5

58869f38dea5e6b4c533784eddf3f56f
SHA1

ecdc31a7f5ea9eb2cfdb088a3fc1b44895cd85f0
SHA256

02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e
SHA512

fcafb59ebf16df7f888e7b9ad4eafc6ad09b68ced4e1e3a4bd74d26534b3fc1d6c8cec5299d5b23743f9cb8704e3915895e712c1c96b68ae1564c52b2b66f655
SSDEEP

24576:iio2C4Tz86EE1by3swR9HrwNmojHuD/bsytUltKo+5+VYrle5sj:k4TzJJm9R9kFTSbNtkwo+5Vrle5a

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe

description	pid	process	target process
PID 5080 set thread context of 1508	5080	02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe	02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe

pid	process
1508	02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe
1508	02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe
1508	02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe
1508	02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe
1508	02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe

description	pid	process	target process
PID 5080 wrote to memory of 1508	5080	02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe	02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe
PID 5080 wrote to memory of 1508	5080	02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe	02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe
PID 5080 wrote to memory of 1508	5080	02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe	02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe
PID 5080 wrote to memory of 1508	5080	02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe	02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe
PID 5080 wrote to memory of 1508	5080	02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe	02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe
PID 5080 wrote to memory of 1508	5080	02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe	02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe
PID 5080 wrote to memory of 1508	5080	02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe	02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe
PID 5080 wrote to memory of 1508	5080	02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe	02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe
PID 5080 wrote to memory of 1508	5080	02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe	02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe
PID 5080 wrote to memory of 1508	5080	02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe	02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe

C:\Users\Admin\AppData\Local\Temp\02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe
"C:\Users\Admin\AppData\Local\Temp\02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5080

C:\Users\Admin\AppData\Local\Temp\02d217320ac0487dc48d909f00797795f1b78846f471fd0b80e2dd4f9ac7656e.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:1508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1508-132-0x0000000000000000-mapping.dmp

Download
memory/1508-133-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1508-134-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1508-135-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1508-136-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1508-137-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download