dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc

Analysis

max time kernel
111s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe
Size

1.3MB
MD5

20b00dd186254ab6a8ae6634b6dab2bd
SHA1

b7b1e41513d81020f1db74f5383060c0679f4f4c
SHA256

dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc
SHA512

d09b992c75c8d8e9960a9a79fbdafa7b2d927d957e356e5ff33d5c639da986108153722d52571f2961447b5893de0c5a11708d33f4d8fc5c1c3c94d8ba0ab749
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak6:TrKo4ZwCOnYjVmJPap

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe

description	pid	process	target process
PID 1808 set thread context of 3136	1808	dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe	dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe

pid	process
3136	dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe
3136	dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe
3136	dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe
3136	dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe
3136	dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe

description	pid	process	target process
PID 1808 wrote to memory of 3136	1808	dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe	dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe
PID 1808 wrote to memory of 3136	1808	dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe	dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe
PID 1808 wrote to memory of 3136	1808	dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe	dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe
PID 1808 wrote to memory of 3136	1808	dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe	dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe
PID 1808 wrote to memory of 3136	1808	dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe	dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe
PID 1808 wrote to memory of 3136	1808	dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe	dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe
PID 1808 wrote to memory of 3136	1808	dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe	dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe
PID 1808 wrote to memory of 3136	1808	dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe	dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe
PID 1808 wrote to memory of 3136	1808	dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe	dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe
PID 1808 wrote to memory of 3136	1808	dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe	dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe

C:\Users\Admin\AppData\Local\Temp\dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe
"C:\Users\Admin\AppData\Local\Temp\dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1808

C:\Users\Admin\AppData\Local\Temp\dd27e7844f7bad5a543977d50a7a43460e02d0870a392ced5d322c93d0b299bc.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:3136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3136-132-0x0000000000000000-mapping.dmp

Download
memory/3136-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3136-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3136-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3136-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3136-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3136-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download