e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d

Analysis

max time kernel
290s
max time network
344s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe
Size

1.3MB
MD5

eff896df35957d01aca1c28fe5c4f17a
SHA1

1c05e675157148601da35309d3c0f3a03e9dba98
SHA256

e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d
SHA512

41364ff3abe6971d6458e30a859f86d2b666805fac2ce7d4ede2be06eef117be45ee4cc614dcd2a7ebf6d3959b7764d8f3b76c13e1d9a46cd94aa50a1a0c6723
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakB:7rKo4ZwCOnYjVmJPaK

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe

description	pid	process	target process
PID 5072 set thread context of 2172	5072	e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe	e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe

pid	process
2172	e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe
2172	e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe
2172	e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe
2172	e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe
2172	e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe

description	pid	process	target process
PID 5072 wrote to memory of 2172	5072	e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe	e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe
PID 5072 wrote to memory of 2172	5072	e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe	e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe
PID 5072 wrote to memory of 2172	5072	e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe	e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe
PID 5072 wrote to memory of 2172	5072	e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe	e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe
PID 5072 wrote to memory of 2172	5072	e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe	e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe
PID 5072 wrote to memory of 2172	5072	e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe	e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe
PID 5072 wrote to memory of 2172	5072	e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe	e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe
PID 5072 wrote to memory of 2172	5072	e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe	e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe
PID 5072 wrote to memory of 2172	5072	e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe	e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe
PID 5072 wrote to memory of 2172	5072	e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe	e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe

C:\Users\Admin\AppData\Local\Temp\e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe
"C:\Users\Admin\AppData\Local\Temp\e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5072

C:\Users\Admin\AppData\Local\Temp\e65afbc1668e3ea9e02c7923fdc4abffb087c277d52cfbabdaedda9f3be5fe5d.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:2172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2172-132-0x0000000000000000-mapping.dmp

Download
memory/2172-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2172-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2172-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2172-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download