daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d

Analysis

max time kernel
150s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe
Size

1.3MB
MD5

3971dee66f3f0f6e675ed4bf047e9f41
SHA1

9503b965859c7184e4a3fdcfefafc9ca647d52f1
SHA256

daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d
SHA512

46838f53f5a6e1478fc4fd6de633dac703ceb25cf381e0701e65d88d520d78718b71c02e498c3c1f0dd0689407d9760b90d87bf23f2b839cef8a940e0b5789c5
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak1:zrKo4ZwCOnYjVmJPa+

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe

description	pid	process	target process
PID 4244 set thread context of 2092	4244	daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe	daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe

pid	process
2092	daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe
2092	daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe
2092	daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe
2092	daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe
2092	daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe

description	pid	process	target process
PID 4244 wrote to memory of 2092	4244	daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe	daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe
PID 4244 wrote to memory of 2092	4244	daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe	daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe
PID 4244 wrote to memory of 2092	4244	daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe	daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe
PID 4244 wrote to memory of 2092	4244	daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe	daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe
PID 4244 wrote to memory of 2092	4244	daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe	daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe
PID 4244 wrote to memory of 2092	4244	daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe	daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe
PID 4244 wrote to memory of 2092	4244	daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe	daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe
PID 4244 wrote to memory of 2092	4244	daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe	daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe
PID 4244 wrote to memory of 2092	4244	daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe	daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe
PID 4244 wrote to memory of 2092	4244	daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe	daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe

C:\Users\Admin\AppData\Local\Temp\daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe
"C:\Users\Admin\AppData\Local\Temp\daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4244

C:\Users\Admin\AppData\Local\Temp\daf47cce96ad15ba2c8eae5a287c553d0e146f6c9591bcc02755948bd0dbab4d.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:2092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2092-132-0x0000000000000000-mapping.dmp

Download
memory/2092-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2092-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2092-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2092-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2092-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download