db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105

Analysis

max time kernel
147s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe
Size

1.3MB
MD5

bbead96d6486787bf73eacf74f1d7023
SHA1

b6b68482e4d7e5684dd4903e32c98aa0e094ce8b
SHA256

db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105
SHA512

a110913b3342c1a7bb0166a88c45567e1bfb6162f3f0ffa5f4a9e69043887c3337ff5fccc4741f7778eb2e56f908def1fb05f4cab77d5099078b6f8e388b2c87
SSDEEP

24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakO:jrKo4ZwCOnYjVmJPaR

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe

description	pid	process	target process
PID 4028 set thread context of 924	4028	db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe	db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe

pid	process
924	db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe
924	db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe
924	db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe
924	db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe
924	db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe

description	pid	process	target process
PID 4028 wrote to memory of 924	4028	db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe	db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe
PID 4028 wrote to memory of 924	4028	db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe	db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe
PID 4028 wrote to memory of 924	4028	db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe	db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe
PID 4028 wrote to memory of 924	4028	db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe	db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe
PID 4028 wrote to memory of 924	4028	db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe	db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe
PID 4028 wrote to memory of 924	4028	db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe	db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe
PID 4028 wrote to memory of 924	4028	db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe	db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe
PID 4028 wrote to memory of 924	4028	db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe	db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe
PID 4028 wrote to memory of 924	4028	db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe	db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe
PID 4028 wrote to memory of 924	4028	db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe	db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe

C:\Users\Admin\AppData\Local\Temp\db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe
"C:\Users\Admin\AppData\Local\Temp\db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4028

C:\Users\Admin\AppData\Local\Temp\db37fbf8867ebf2de7fe5253b09863e9d6ead54604ad9384efe5271da2116105.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/924-132-0x0000000000000000-mapping.dmp

Download
memory/924-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/924-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/924-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/924-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/924-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download