bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162

Analysis

max time kernel
189s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe
Size

1.3MB
MD5

ed0af12645d3b276419be806026e1edb
SHA1

2d3731f1b70325fbdb9c52f4da814f8d6006d7a6
SHA256

bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162
SHA512

3e68e1f717c232dae8416d4aaa92aed372cf526e65d6582cd92b4157b241312697ed2f673c072d0a4f4cb20fdf25bf56974ad1c96e250a6703e08b6886dfeac9
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPaki:zrKo4ZwCOnYjVmJPat

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe

description	pid	process	target process
PID 5080 set thread context of 4708	5080	bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe	bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe

pid	process
4708	bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe
4708	bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe
4708	bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe
4708	bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe
4708	bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe

description	pid	process	target process
PID 5080 wrote to memory of 4708	5080	bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe	bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe
PID 5080 wrote to memory of 4708	5080	bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe	bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe
PID 5080 wrote to memory of 4708	5080	bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe	bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe
PID 5080 wrote to memory of 4708	5080	bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe	bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe
PID 5080 wrote to memory of 4708	5080	bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe	bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe
PID 5080 wrote to memory of 4708	5080	bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe	bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe
PID 5080 wrote to memory of 4708	5080	bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe	bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe
PID 5080 wrote to memory of 4708	5080	bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe	bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe
PID 5080 wrote to memory of 4708	5080	bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe	bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe
PID 5080 wrote to memory of 4708	5080	bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe	bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe

C:\Users\Admin\AppData\Local\Temp\bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe
"C:\Users\Admin\AppData\Local\Temp\bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5080

C:\Users\Admin\AppData\Local\Temp\bd84822a2a7cc6096e8542f3af77b6686566dea3263217ddfab82774dcf30162.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4708-135-0x0000000000000000-mapping.dmp

Download
memory/4708-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4708-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4708-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4708-139-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4708-140-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download