b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5

Analysis

max time kernel
137s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe
Size

1.3MB
MD5

1954c330c693056888f82638513e79c8
SHA1

fd8fd4a9145364b93bddb1ab4ea2ff3a0d6d514c
SHA256

b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5
SHA512

8625d97fc0487e9fe320921abd4a45251960b60e1090c6bc2760ace493109258b7bdefd9772443335d8fe95e7ac2594e2625ee3d6c097fface754ff0b66060cd
SSDEEP

24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak7:jrKo4ZwCOnYjVmJPaE

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe

description	pid	process	target process
PID 3968 set thread context of 2412	3968	b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe	b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe

pid	process
2412	b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe
2412	b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe
2412	b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe
2412	b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe
2412	b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe

description	pid	process	target process
PID 3968 wrote to memory of 2412	3968	b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe	b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe
PID 3968 wrote to memory of 2412	3968	b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe	b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe
PID 3968 wrote to memory of 2412	3968	b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe	b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe
PID 3968 wrote to memory of 2412	3968	b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe	b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe
PID 3968 wrote to memory of 2412	3968	b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe	b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe
PID 3968 wrote to memory of 2412	3968	b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe	b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe
PID 3968 wrote to memory of 2412	3968	b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe	b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe
PID 3968 wrote to memory of 2412	3968	b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe	b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe
PID 3968 wrote to memory of 2412	3968	b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe	b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe
PID 3968 wrote to memory of 2412	3968	b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe	b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe

C:\Users\Admin\AppData\Local\Temp\b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe
"C:\Users\Admin\AppData\Local\Temp\b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Users\Admin\AppData\Local\Temp\b628343732e871b752de6065a87efaceb5bcb04a19c41e9b8b88d938f21e42f5.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2412-132-0x0000000000000000-mapping.dmp

Download
memory/2412-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2412-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2412-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2412-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2412-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2412-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download