Analysis

  • max time kernel
    147s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 09:55

General

  • Target

    c79cb7b8f25ac6bcc77a7d49f12c8bc135ee91489190e075001c844cfe540394.exe

  • Size

    1.3MB

  • MD5

    73b466eb1ff2c2340a09b11d3c26b9fa

  • SHA1

    0215bafa98a7cc2d667900f6c6fa852acef3af22

  • SHA256

    c79cb7b8f25ac6bcc77a7d49f12c8bc135ee91489190e075001c844cfe540394

  • SHA512

    1aa169ce0ae30d9f063f4653209d44d9f7fcf4beef39931794804c18bce39912417a36f478a703bd5bb6504b9e5385e9f385440091f4e752a38bba5eb1a8e914

  • SSDEEP

    24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakr:jrKo4ZwCOnYjVmJPaU

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c79cb7b8f25ac6bcc77a7d49f12c8bc135ee91489190e075001c844cfe540394.exe
    "C:\Users\Admin\AppData\Local\Temp\c79cb7b8f25ac6bcc77a7d49f12c8bc135ee91489190e075001c844cfe540394.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4528
    • C:\Users\Admin\AppData\Local\Temp\c79cb7b8f25ac6bcc77a7d49f12c8bc135ee91489190e075001c844cfe540394.exe
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:1484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1484-132-0x0000000000000000-mapping.dmp

  • memory/1484-133-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/1484-134-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/1484-135-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/1484-136-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/1484-137-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/1484-138-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB