9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c

Analysis

max time kernel
148s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe
Size

1.3MB
MD5

59522838e53dd0ad2fba0b6437cceb8f
SHA1

58c9e941afdde8efb1ea877abbb3e376a8ad4b5b
SHA256

9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c
SHA512

ced5251c72e1b3dd1fb6756a771cf52f6427c0adfd63272ffacad37f9bf2eea6deb125dc24e22009a57bdd4c8a697cb4c478ddfe6236c330610bb66ae81951ce
SSDEEP

24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakm:jrKo4ZwCOnYjVmJPax

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe

description	pid	process	target process
PID 4756 set thread context of 652	4756	9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe	9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe

pid	process
652	9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe
652	9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe
652	9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe
652	9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe
652	9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe

description	pid	process	target process
PID 4756 wrote to memory of 652	4756	9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe	9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe
PID 4756 wrote to memory of 652	4756	9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe	9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe
PID 4756 wrote to memory of 652	4756	9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe	9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe
PID 4756 wrote to memory of 652	4756	9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe	9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe
PID 4756 wrote to memory of 652	4756	9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe	9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe
PID 4756 wrote to memory of 652	4756	9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe	9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe
PID 4756 wrote to memory of 652	4756	9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe	9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe
PID 4756 wrote to memory of 652	4756	9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe	9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe
PID 4756 wrote to memory of 652	4756	9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe	9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe
PID 4756 wrote to memory of 652	4756	9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe	9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe

C:\Users\Admin\AppData\Local\Temp\9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe
"C:\Users\Admin\AppData\Local\Temp\9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4756

C:\Users\Admin\AppData\Local\Temp\9d086aa42274ec17040e774bbaf15cad4893516df7048dff1768d8b60c38cc2c.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/652-132-0x0000000000000000-mapping.dmp

Download
memory/652-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/652-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/652-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/652-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/652-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download