d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8

Analysis

max time kernel
138s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe
Size

1.3MB
MD5

449d4e3c8f851530f7c5076c4e00f282
SHA1

5e46c32a1c99d19693bf8345fd9d3c98b1085aff
SHA256

d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8
SHA512

25279949d41d5a9d2cd647cb7fa511d68a03d16d8a66f795e603647fdbbec33e36bc791b258b0a439a4cfd55277612c3e0610d74fd9a790e69e430fb6f322972
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak:TrKo4ZwCOnYjVmJPa

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe

description	pid	process	target process
PID 2144 set thread context of 3708	2144	d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe	d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe

pid	process
3708	d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe
3708	d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe
3708	d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe
3708	d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe
3708	d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe

description	pid	process	target process
PID 2144 wrote to memory of 3708	2144	d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe	d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe
PID 2144 wrote to memory of 3708	2144	d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe	d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe
PID 2144 wrote to memory of 3708	2144	d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe	d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe
PID 2144 wrote to memory of 3708	2144	d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe	d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe
PID 2144 wrote to memory of 3708	2144	d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe	d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe
PID 2144 wrote to memory of 3708	2144	d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe	d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe
PID 2144 wrote to memory of 3708	2144	d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe	d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe
PID 2144 wrote to memory of 3708	2144	d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe	d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe
PID 2144 wrote to memory of 3708	2144	d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe	d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe
PID 2144 wrote to memory of 3708	2144	d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe	d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe

C:\Users\Admin\AppData\Local\Temp\d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe
"C:\Users\Admin\AppData\Local\Temp\d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2144

C:\Users\Admin\AppData\Local\Temp\d361a20c75a6ab9c0c61e249e0185036174c774d59a19b8f08ee4babd66e60b8.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:3708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3708-132-0x0000000000000000-mapping.dmp

Download
memory/3708-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3708-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3708-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3708-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3708-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3708-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download