bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162

Analysis

max time kernel
332s
max time network
389s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe
Size

1.3MB
MD5

4862d0007e9248c96109d92d5889b042
SHA1

6cb3ead8ee529c4e770b090647ff1379e51812db
SHA256

bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162
SHA512

e0c802e40a547593b8b37d06a4d326dc8cbcc990ae0cd86880130829aad58b0ce69e5432b5427902dd4834a2dce09c990cad7e9d2c9279ab03e7ece05f7f912c
SSDEEP

24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakG:jrKo4ZwCOnYjVmJPal

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe

description	pid	process	target process
PID 1484 set thread context of 4200	1484	bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe	bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe

pid	process
4200	bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe
4200	bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe
4200	bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe
4200	bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe
4200	bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe

description	pid	process	target process
PID 1484 wrote to memory of 4200	1484	bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe	bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe
PID 1484 wrote to memory of 4200	1484	bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe	bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe
PID 1484 wrote to memory of 4200	1484	bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe	bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe
PID 1484 wrote to memory of 4200	1484	bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe	bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe
PID 1484 wrote to memory of 4200	1484	bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe	bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe
PID 1484 wrote to memory of 4200	1484	bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe	bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe
PID 1484 wrote to memory of 4200	1484	bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe	bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe
PID 1484 wrote to memory of 4200	1484	bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe	bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe
PID 1484 wrote to memory of 4200	1484	bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe	bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe
PID 1484 wrote to memory of 4200	1484	bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe	bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe

C:\Users\Admin\AppData\Local\Temp\bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe
"C:\Users\Admin\AppData\Local\Temp\bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1484

C:\Users\Admin\AppData\Local\Temp\bd550da6a7640a276e224619e6499dd73a5bcd66da14cf1e80fc98358abe4162.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4200-132-0x0000000000000000-mapping.dmp

Download
memory/4200-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4200-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4200-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4200-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4200-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download