d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010

Analysis

max time kernel
185s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe
Size

1.3MB
MD5

f4c856232f90d2bd710c3bceb6623081
SHA1

4e0af7e19a1d50df3bbacadab20e56fd608dd30c
SHA256

d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010
SHA512

19373741f71931975895cc27e45629d662a33eceade69cef29a93e7404bd4c00bafcbccf543aac42bd23e325ab73733bb29bea5d855b3055c57a623973348908
SSDEEP

24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakH:jrKo4ZwCOnYjVmJPaM

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe

description	pid	process	target process
PID 1728 set thread context of 3200	1728	d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe	d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe

pid	process
3200	d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe
3200	d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe
3200	d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe
3200	d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe
3200	d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe

description	pid	process	target process
PID 1728 wrote to memory of 3200	1728	d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe	d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe
PID 1728 wrote to memory of 3200	1728	d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe	d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe
PID 1728 wrote to memory of 3200	1728	d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe	d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe
PID 1728 wrote to memory of 3200	1728	d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe	d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe
PID 1728 wrote to memory of 3200	1728	d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe	d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe
PID 1728 wrote to memory of 3200	1728	d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe	d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe
PID 1728 wrote to memory of 3200	1728	d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe	d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe
PID 1728 wrote to memory of 3200	1728	d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe	d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe
PID 1728 wrote to memory of 3200	1728	d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe	d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe
PID 1728 wrote to memory of 3200	1728	d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe	d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe

C:\Users\Admin\AppData\Local\Temp\d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe
"C:\Users\Admin\AppData\Local\Temp\d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1728

C:\Users\Admin\AppData\Local\Temp\d1c9e28c4d207b7e33b2563f6679c9767e3b10e325ce4d2f89ba7c1d926e0010.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:3200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3200-132-0x0000000000000000-mapping.dmp

Download
memory/3200-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3200-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3200-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3200-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3200-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3200-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download