df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a

Analysis

max time kernel
151s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe
Size

1.3MB
MD5

5a4c806581a97ee24f9f4f57b85a5e06
SHA1

6f6781b422b48edca45546644b7f7eed28af603d
SHA256

df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a
SHA512

21a3c91acf6e02803b3cee7a274f21a7d97229e20bb459085de10f52b962670d4b98e1ed7ad27953a65847fef9044a4920c2421f0eefea5bdb3e011225b570dc
SSDEEP

24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakU:jrKo4ZwCOnYjVmJPaX

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe

description	pid	process	target process
PID 4696 set thread context of 4976	4696	df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe	df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe

pid	process
4976	df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe
4976	df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe
4976	df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe
4976	df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe
4976	df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe

description	pid	process	target process
PID 4696 wrote to memory of 4976	4696	df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe	df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe
PID 4696 wrote to memory of 4976	4696	df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe	df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe
PID 4696 wrote to memory of 4976	4696	df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe	df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe
PID 4696 wrote to memory of 4976	4696	df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe	df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe
PID 4696 wrote to memory of 4976	4696	df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe	df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe
PID 4696 wrote to memory of 4976	4696	df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe	df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe
PID 4696 wrote to memory of 4976	4696	df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe	df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe
PID 4696 wrote to memory of 4976	4696	df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe	df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe
PID 4696 wrote to memory of 4976	4696	df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe	df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe
PID 4696 wrote to memory of 4976	4696	df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe	df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe

C:\Users\Admin\AppData\Local\Temp\df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe
"C:\Users\Admin\AppData\Local\Temp\df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4696

C:\Users\Admin\AppData\Local\Temp\df81ed04981199c77ffda0d2ff7659decfbb0c964e7b9cfb2a461d91a2863d7a.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4976-135-0x0000000000000000-mapping.dmp

Download
memory/4976-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4976-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4976-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4976-139-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download