e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83

Analysis

max time kernel
186s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe
Size

1.3MB
MD5

885259ddfd25d9f5029f96c9a64febae
SHA1

1d89ed8435a66c100a8dc3ff3dfc3310b778adb0
SHA256

e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83
SHA512

3455549e339cc8225db206cc0aff68e503063007e80bebe93cef8635a21aba588868c5e6e9cdb0daefe98576f82c14d3bc674f171acd2753d5352be2701192c9
SSDEEP

24576:rrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak:rrKo4ZwCOnYjVmJPa

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe

description	pid	process	target process
PID 232 set thread context of 4292	232	e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe	e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe

pid	process
4292	e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe
4292	e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe
4292	e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe
4292	e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe
4292	e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe

description	pid	process	target process
PID 232 wrote to memory of 4292	232	e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe	e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe
PID 232 wrote to memory of 4292	232	e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe	e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe
PID 232 wrote to memory of 4292	232	e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe	e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe
PID 232 wrote to memory of 4292	232	e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe	e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe
PID 232 wrote to memory of 4292	232	e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe	e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe
PID 232 wrote to memory of 4292	232	e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe	e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe
PID 232 wrote to memory of 4292	232	e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe	e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe
PID 232 wrote to memory of 4292	232	e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe	e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe
PID 232 wrote to memory of 4292	232	e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe	e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe
PID 232 wrote to memory of 4292	232	e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe	e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe

C:\Users\Admin\AppData\Local\Temp\e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe
"C:\Users\Admin\AppData\Local\Temp\e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:232

C:\Users\Admin\AppData\Local\Temp\e2d530f9492b758dfd457c303e04000d1951737946f550d2be2390e79b777e83.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4292-132-0x0000000000000000-mapping.dmp

Download
memory/4292-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4292-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4292-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4292-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4292-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download