d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056

Analysis

max time kernel
178s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe
Size

1.3MB
MD5

2e595896e771b841d1afeea40c4c8467
SHA1

6ec31c5971f6f13e68261199d38f7c71b5e361a9
SHA256

d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056
SHA512

741a60a82d802450a8505f4673bf124c9e455ac5cde09adf326019c920fe4e6942b90fdbee45fbb0be18c0f62cea6503928e697df2ec266ba0448b6024c88a17
SSDEEP

24576:LrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak:LrKo4ZwCOnYjVmJPa

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe

description	pid	process	target process
PID 1952 set thread context of 4548	1952	d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe	d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe

pid	process
4548	d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe
4548	d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe
4548	d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe
4548	d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe
4548	d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe

description	pid	process	target process
PID 1952 wrote to memory of 4548	1952	d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe	d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe
PID 1952 wrote to memory of 4548	1952	d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe	d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe
PID 1952 wrote to memory of 4548	1952	d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe	d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe
PID 1952 wrote to memory of 4548	1952	d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe	d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe
PID 1952 wrote to memory of 4548	1952	d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe	d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe
PID 1952 wrote to memory of 4548	1952	d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe	d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe
PID 1952 wrote to memory of 4548	1952	d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe	d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe
PID 1952 wrote to memory of 4548	1952	d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe	d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe
PID 1952 wrote to memory of 4548	1952	d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe	d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe
PID 1952 wrote to memory of 4548	1952	d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe	d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe

C:\Users\Admin\AppData\Local\Temp\d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe
"C:\Users\Admin\AppData\Local\Temp\d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1952

C:\Users\Admin\AppData\Local\Temp\d6625280500588f78f4899d3bc7ddd95b25b369b1626efc393e41ad44f7d3056.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4548-132-0x0000000000000000-mapping.dmp

Download
memory/4548-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4548-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4548-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4548-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4548-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4548-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download