a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782

Analysis

max time kernel
92s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe
Size

1.3MB
MD5

4058718ed0fa898ff0fb76d06479299f
SHA1

8156bc7189e0955f5b54b49323106c0b5d443ea5
SHA256

a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782
SHA512

a3d2d896e744216878f09a1d18b165ce6e26e0c3c46b1207ac04e9c7565d47a0187479ba48de63e7ce755c74dff86160599630b9b13ebdec8675ad9f534ef4ef
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPako:zrKo4ZwCOnYjVmJPar

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe

description	pid	process	target process
PID 1588 set thread context of 4964	1588	a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe	a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe

pid	process
4964	a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe
4964	a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe
4964	a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe
4964	a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe
4964	a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe

description	pid	process	target process
PID 1588 wrote to memory of 4964	1588	a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe	a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe
PID 1588 wrote to memory of 4964	1588	a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe	a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe
PID 1588 wrote to memory of 4964	1588	a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe	a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe
PID 1588 wrote to memory of 4964	1588	a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe	a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe
PID 1588 wrote to memory of 4964	1588	a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe	a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe
PID 1588 wrote to memory of 4964	1588	a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe	a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe
PID 1588 wrote to memory of 4964	1588	a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe	a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe
PID 1588 wrote to memory of 4964	1588	a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe	a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe
PID 1588 wrote to memory of 4964	1588	a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe	a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe
PID 1588 wrote to memory of 4964	1588	a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe	a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe

C:\Users\Admin\AppData\Local\Temp\a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe
"C:\Users\Admin\AppData\Local\Temp\a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1588

C:\Users\Admin\AppData\Local\Temp\a2a33d05da6d24c1df68dacaaeebd93fe9a676b689018c2170da9748c68f3782.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4964-132-0x0000000000000000-mapping.dmp

Download
memory/4964-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4964-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4964-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4964-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4964-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4964-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download