e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe
Size

1.3MB
MD5

d49f188722ce14c64611c2369e6f0347
SHA1

61c9e1a1ad8b41af70f17820d4af7e2161d5ae79
SHA256

e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff
SHA512

ff38b395fc14ea1d6171e6b1e0da083e8e3b0e1fb7248c11159570c7f71910fd0704c6b06152e0640f3c85a0e1690883f1368679ab9a37ef0872034d134b82d2
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak9:TrKo4ZwCOnYjVmJPaq

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe

description	pid	process	target process
PID 4588 set thread context of 792	4588	e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe	e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe

pid	process
792	e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe
792	e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe
792	e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe
792	e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe
792	e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe

description	pid	process	target process
PID 4588 wrote to memory of 792	4588	e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe	e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe
PID 4588 wrote to memory of 792	4588	e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe	e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe
PID 4588 wrote to memory of 792	4588	e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe	e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe
PID 4588 wrote to memory of 792	4588	e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe	e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe
PID 4588 wrote to memory of 792	4588	e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe	e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe
PID 4588 wrote to memory of 792	4588	e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe	e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe
PID 4588 wrote to memory of 792	4588	e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe	e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe
PID 4588 wrote to memory of 792	4588	e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe	e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe
PID 4588 wrote to memory of 792	4588	e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe	e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe
PID 4588 wrote to memory of 792	4588	e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe	e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe

C:\Users\Admin\AppData\Local\Temp\e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe
"C:\Users\Admin\AppData\Local\Temp\e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4588

C:\Users\Admin\AppData\Local\Temp\e4c995ca813b3f5b50521d420a18f60580947f71123f834b5673d0a07ac2b9ff.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/792-132-0x0000000000000000-mapping.dmp

Download
memory/792-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/792-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/792-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/792-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/792-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download