d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee

Analysis

max time kernel
150s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe
Size

1.3MB
MD5

f1bde612b598e133c3fee230ad5514ab
SHA1

bca4b773e8f87f9e6d33321e4a7b1cb57a5d68e2
SHA256

d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee
SHA512

8f2377f6be64e39e37b38b17722c4c2d2cda9a12ca339ae8040e6d95f2b28d49e3cee2a150caacd601f3191d872fe26c58f58ce04e74026748b31746a2c09bbd
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak:TrKo4ZwCOnYjVmJPa

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe

description	pid	process	target process
PID 4312 set thread context of 1372	4312	d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe	d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe

pid	process
1372	d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe
1372	d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe
1372	d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe
1372	d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe
1372	d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe

description	pid	process	target process
PID 4312 wrote to memory of 1372	4312	d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe	d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe
PID 4312 wrote to memory of 1372	4312	d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe	d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe
PID 4312 wrote to memory of 1372	4312	d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe	d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe
PID 4312 wrote to memory of 1372	4312	d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe	d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe
PID 4312 wrote to memory of 1372	4312	d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe	d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe
PID 4312 wrote to memory of 1372	4312	d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe	d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe
PID 4312 wrote to memory of 1372	4312	d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe	d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe
PID 4312 wrote to memory of 1372	4312	d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe	d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe
PID 4312 wrote to memory of 1372	4312	d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe	d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe
PID 4312 wrote to memory of 1372	4312	d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe	d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe

C:\Users\Admin\AppData\Local\Temp\d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe
"C:\Users\Admin\AppData\Local\Temp\d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4312

C:\Users\Admin\AppData\Local\Temp\d90eb81f6810751237697b3dc613f25c564034951b4095633e5b2ac8708702ee.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:1372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1372-132-0x0000000000000000-mapping.dmp

Download
memory/1372-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1372-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1372-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1372-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1372-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1372-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download