Analysis
-
max time kernel
178s -
max time network
188s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 09:57
Static task
static1
Behavioral task
behavioral1
Sample
c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe
Resource
win10v2004-20220812-en
General
-
Target
c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe
-
Size
1.3MB
-
MD5
80668e9411b1d622148943c003b98060
-
SHA1
79bcf0c7ebfa3fb3988bbb0a33c12033184bf352
-
SHA256
c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00
-
SHA512
6171cd4f41574631b657afdb8b00c1978d6aaf2c7fcb08f1d102ab641c36bc18dbda662fa60173ade3b96afc30d4429e6e754a22665a1e7cc9137f9c7f8c2e17
-
SSDEEP
24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakB:jrKo4ZwCOnYjVmJPaW
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exedescription pid process target process PID 1988 set thread context of 4364 1988 c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exepid process 4364 c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe 4364 c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe 4364 c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe 4364 c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe 4364 c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exedescription pid process target process PID 1988 wrote to memory of 4364 1988 c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe PID 1988 wrote to memory of 4364 1988 c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe PID 1988 wrote to memory of 4364 1988 c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe PID 1988 wrote to memory of 4364 1988 c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe PID 1988 wrote to memory of 4364 1988 c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe PID 1988 wrote to memory of 4364 1988 c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe PID 1988 wrote to memory of 4364 1988 c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe PID 1988 wrote to memory of 4364 1988 c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe PID 1988 wrote to memory of 4364 1988 c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe PID 1988 wrote to memory of 4364 1988 c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe"C:\Users\Admin\AppData\Local\Temp\c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\c62bf443e86127354bb6962d098d4736af065fde8cbbb25379440172be7a7f00.exe
- Suspicious use of SetWindowsHookEx
PID:4364