dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18

Analysis

max time kernel
190s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe
Size

1.3MB
MD5

985e333004530841b62fe0ee4f125187
SHA1

ddc4aabf7b78a20113113fa043deae81f4e66e41
SHA256

dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18
SHA512

1ee48aad6bdae0dc8e8e516489d9a8049b6eb7d2c50ab0d08d6218b3196bf9c6660602ba73ef9dd74528b1817f7fb5216460b3ef03ab407cd9c05ab84ef45720
SSDEEP

24576:brKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPaka:brKo4ZwCOnYjVmJPax

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe

description	pid	process	target process
PID 3124 set thread context of 2600	3124	dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe	dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe

pid	process
2600	dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe
2600	dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe
2600	dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe
2600	dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe
2600	dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe

description	pid	process	target process
PID 3124 wrote to memory of 2600	3124	dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe	dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe
PID 3124 wrote to memory of 2600	3124	dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe	dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe
PID 3124 wrote to memory of 2600	3124	dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe	dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe
PID 3124 wrote to memory of 2600	3124	dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe	dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe
PID 3124 wrote to memory of 2600	3124	dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe	dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe
PID 3124 wrote to memory of 2600	3124	dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe	dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe
PID 3124 wrote to memory of 2600	3124	dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe	dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe
PID 3124 wrote to memory of 2600	3124	dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe	dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe
PID 3124 wrote to memory of 2600	3124	dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe	dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe
PID 3124 wrote to memory of 2600	3124	dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe	dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe

C:\Users\Admin\AppData\Local\Temp\dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe
"C:\Users\Admin\AppData\Local\Temp\dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3124

C:\Users\Admin\AppData\Local\Temp\dd6912aa72514a05128211e91b11de299c0cbb5e936700e84f5e7fbe8b62ea18.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:2600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2600-132-0x0000000000000000-mapping.dmp

Download
memory/2600-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2600-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2600-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2600-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2600-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2600-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download