Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 10:14
Static task
static1
Behavioral task
behavioral1
Sample
bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe
Resource
win10v2004-20220812-en
General
-
Target
bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe
-
Size
1.2MB
-
MD5
621fe82cbc6d63a486c28e32d9910a5e
-
SHA1
ae48f573beec958fb80add00836d4d4cd526bfae
-
SHA256
bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc
-
SHA512
bff9880ada96318b86f7f220c04034bcaadeab86505d6ebbdaca7f3871b1a65fdf089d72adb390403f20196665c29f591586f26da0008cf355cdc0d8132c4d5b
-
SSDEEP
12288:dSGxzDKw6w2qa3LgMc8SLFDY/8LeS2899E7D3AYNACMzb7noKcxl4B6obXWRAfby:cxw8wFDY3wE3wY6cxI6gWUbIwMLHf/
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exedescription pid process target process PID 5048 set thread context of 4776 5048 bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exepid process 4776 bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe 4776 bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe 4776 bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe 4776 bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe 4776 bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exedescription pid process target process PID 5048 wrote to memory of 4776 5048 bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe PID 5048 wrote to memory of 4776 5048 bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe PID 5048 wrote to memory of 4776 5048 bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe PID 5048 wrote to memory of 4776 5048 bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe PID 5048 wrote to memory of 4776 5048 bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe PID 5048 wrote to memory of 4776 5048 bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe PID 5048 wrote to memory of 4776 5048 bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe PID 5048 wrote to memory of 4776 5048 bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe PID 5048 wrote to memory of 4776 5048 bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe PID 5048 wrote to memory of 4776 5048 bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe"C:\Users\Admin\AppData\Local\Temp\bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe"C:\Users\Admin\AppData\Local\Temp\bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:4776