dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8

Analysis

max time kernel
299s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe
Size

1.3MB
MD5

e80b2bf8871f09b1b65dfdf978e6841f
SHA1

f181f6230ff11573a98cd4b58dfa2d5fcdc61ac6
SHA256

dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8
SHA512

85c4819411fee8cad4f4f5dc3901cfcd1b7d5e105c79b694a1fafb47db8afb748487b3f8da28d7f69044a796119ad95c9e2a052c3026296a334eeb7d2fd7fd8b
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakI:7rKo4ZwCOnYjVmJPab

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe

description	pid	process	target process
PID 3708 set thread context of 3544	3708	dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe	dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe

pid	process
3544	dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe
3544	dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe
3544	dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe
3544	dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe
3544	dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe

description	pid	process	target process
PID 3708 wrote to memory of 3544	3708	dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe	dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe
PID 3708 wrote to memory of 3544	3708	dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe	dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe
PID 3708 wrote to memory of 3544	3708	dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe	dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe
PID 3708 wrote to memory of 3544	3708	dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe	dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe
PID 3708 wrote to memory of 3544	3708	dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe	dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe
PID 3708 wrote to memory of 3544	3708	dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe	dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe
PID 3708 wrote to memory of 3544	3708	dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe	dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe
PID 3708 wrote to memory of 3544	3708	dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe	dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe
PID 3708 wrote to memory of 3544	3708	dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe	dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe
PID 3708 wrote to memory of 3544	3708	dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe	dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe

C:\Users\Admin\AppData\Local\Temp\dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe
"C:\Users\Admin\AppData\Local\Temp\dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3708

C:\Users\Admin\AppData\Local\Temp\dac3b8d24222dc2af7f1cdf47dbc897fb4545654ee0f5ea50a07b7fa256be7c8.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:3544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3544-132-0x0000000000000000-mapping.dmp

Download
memory/3544-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3544-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3544-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3544-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3544-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download