da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837

Analysis

max time kernel
183s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe
Size

1.3MB
MD5

2f47602944962cc4960b05ebc49d791e
SHA1

1433d9ac5fa0b6eafa2559be72a3479f0cc3256b
SHA256

da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837
SHA512

cd2311b0cf2998e87ffb2038125e5783b9fb07de9411e3b4dc0baf9fb8d6c5cf69b4a46981dcd1817d77174ea6c1edca0b98d00620d2daedbe3452350ff2be6f
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakx:zrKo4ZwCOnYjVmJPa+

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe

description	pid	process	target process
PID 4104 set thread context of 2776	4104	da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe	da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe

pid	process
2776	da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe
2776	da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe
2776	da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe
2776	da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe
2776	da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe

description	pid	process	target process
PID 4104 wrote to memory of 2776	4104	da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe	da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe
PID 4104 wrote to memory of 2776	4104	da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe	da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe
PID 4104 wrote to memory of 2776	4104	da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe	da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe
PID 4104 wrote to memory of 2776	4104	da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe	da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe
PID 4104 wrote to memory of 2776	4104	da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe	da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe
PID 4104 wrote to memory of 2776	4104	da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe	da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe
PID 4104 wrote to memory of 2776	4104	da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe	da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe
PID 4104 wrote to memory of 2776	4104	da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe	da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe
PID 4104 wrote to memory of 2776	4104	da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe	da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe
PID 4104 wrote to memory of 2776	4104	da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe	da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe

C:\Users\Admin\AppData\Local\Temp\da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe
"C:\Users\Admin\AppData\Local\Temp\da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4104

C:\Users\Admin\AppData\Local\Temp\da70354bd0e9ca429533029ff9a5d5a3de31f5152a37c657914c2a9171091837.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:2776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2776-132-0x0000000000000000-mapping.dmp

Download
memory/2776-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2776-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2776-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2776-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2776-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2776-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download