99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2

Analysis

max time kernel
92s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe
Size

1.3MB
MD5

dcd1b2bcd17a914df7cc70a1621f9fe4
SHA1

01c57ac5a323f413557807ee6628fbebcf6bd91c
SHA256

99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2
SHA512

c5ae3ef5e176d43bd15c9a97a3c8da5ffd7af5c74a884016e3f9581ce1d137c4d72376bda6d943a38859bc6f9c6e80f5a95d9dcea25090d0f0cf81ee1741b348
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakp:zrKo4ZwCOnYjVmJPaS

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe

description	pid	process	target process
PID 488 set thread context of 5072	488	99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe	99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe

pid	process
5072	99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe
5072	99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe
5072	99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe
5072	99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe
5072	99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe

description	pid	process	target process
PID 488 wrote to memory of 5072	488	99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe	99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe
PID 488 wrote to memory of 5072	488	99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe	99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe
PID 488 wrote to memory of 5072	488	99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe	99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe
PID 488 wrote to memory of 5072	488	99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe	99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe
PID 488 wrote to memory of 5072	488	99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe	99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe
PID 488 wrote to memory of 5072	488	99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe	99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe
PID 488 wrote to memory of 5072	488	99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe	99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe
PID 488 wrote to memory of 5072	488	99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe	99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe
PID 488 wrote to memory of 5072	488	99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe	99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe
PID 488 wrote to memory of 5072	488	99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe	99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe

C:\Users\Admin\AppData\Local\Temp\99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe
"C:\Users\Admin\AppData\Local\Temp\99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:488

C:\Users\Admin\AppData\Local\Temp\99586c7fc40a72fd310a8b12f397f7caf5ba9859eaa9a14988301f187b962dd2.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:5072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5072-132-0x0000000000000000-mapping.dmp

Download
memory/5072-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/5072-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/5072-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/5072-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/5072-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/5072-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download