d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea

Analysis

max time kernel
88s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe
Size

1.3MB
MD5

c6e6cea6cbc385ac21732bc4d217d7f4
SHA1

57641390857b7ae2f420cdbdaf0aa3306713dd56
SHA256

d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea
SHA512

01ef51c58f32b2397d395a3af1fba0df81a5da6f5fb2bd17c59437ed4dd3027b629345665ce5a8bbd467c61fb62c446816318234e0bf4c8a5d65efaf874d554f
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak:zrKo4ZwCOnYjVmJPa

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe

description	pid	process	target process
PID 940 set thread context of 2364	940	d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe	d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe

pid	process
2364	d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe
2364	d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe
2364	d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe
2364	d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe
2364	d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe

description	pid	process	target process
PID 940 wrote to memory of 2364	940	d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe	d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe
PID 940 wrote to memory of 2364	940	d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe	d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe
PID 940 wrote to memory of 2364	940	d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe	d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe
PID 940 wrote to memory of 2364	940	d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe	d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe
PID 940 wrote to memory of 2364	940	d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe	d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe
PID 940 wrote to memory of 2364	940	d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe	d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe
PID 940 wrote to memory of 2364	940	d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe	d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe
PID 940 wrote to memory of 2364	940	d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe	d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe
PID 940 wrote to memory of 2364	940	d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe	d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe
PID 940 wrote to memory of 2364	940	d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe	d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe

C:\Users\Admin\AppData\Local\Temp\d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe
"C:\Users\Admin\AppData\Local\Temp\d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:940

C:\Users\Admin\AppData\Local\Temp\d9d238e037dc7622763bc2a0012344e819856ea533841f96f662675317f484ea.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:2364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2364-132-0x0000000000000000-mapping.dmp

Download
memory/2364-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2364-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2364-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2364-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2364-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2364-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download