Analysis

  • max time kernel
    146s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 10:14

General

  • Target

    bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe

  • Size

    1.2MB

  • MD5

    621fe82cbc6d63a486c28e32d9910a5e

  • SHA1

    ae48f573beec958fb80add00836d4d4cd526bfae

  • SHA256

    bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc

  • SHA512

    bff9880ada96318b86f7f220c04034bcaadeab86505d6ebbdaca7f3871b1a65fdf089d72adb390403f20196665c29f591586f26da0008cf355cdc0d8132c4d5b

  • SSDEEP

    12288:dSGxzDKw6w2qa3LgMc8SLFDY/8LeS2899E7D3AYNACMzb7noKcxl4B6obXWRAfby:cxw8wFDY3wE3wY6cxI6gWUbIwMLHf/

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe
    "C:\Users\Admin\AppData\Local\Temp\bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:5048
    • C:\Users\Admin\AppData\Local\Temp\bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe
      "C:\Users\Admin\AppData\Local\Temp\bb78f2192997a31df85c06e55c36668de42491732b26659d547a985750a713dc.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:4776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4776-132-0x0000000000000000-mapping.dmp

  • memory/4776-133-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/4776-134-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/4776-135-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/4776-136-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/4776-137-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/4776-138-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB