b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe
Size

1.3MB
MD5

ecd226a0eda5eba9a4a90fd3958c2a17
SHA1

1f4b2ebf5c420b94b151f20cd10b34a2871f16a5
SHA256

b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de
SHA512

2055d5a7346f44c7d930eef35c091f4b70b00a68ba0a21036d85479d2c93251d723ec6f1eb3a43260b55050e1fc7c6bfbe04f148d66f379e5624c95ed809505a
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakj:TrKo4ZwCOnYjVmJPao

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe

description	pid	process	target process
PID 3016 set thread context of 4932	3016	b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe	b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe

pid	process
4932	b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe
4932	b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe
4932	b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe
4932	b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe
4932	b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe

description	pid	process	target process
PID 3016 wrote to memory of 4932	3016	b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe	b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe
PID 3016 wrote to memory of 4932	3016	b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe	b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe
PID 3016 wrote to memory of 4932	3016	b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe	b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe
PID 3016 wrote to memory of 4932	3016	b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe	b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe
PID 3016 wrote to memory of 4932	3016	b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe	b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe
PID 3016 wrote to memory of 4932	3016	b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe	b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe
PID 3016 wrote to memory of 4932	3016	b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe	b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe
PID 3016 wrote to memory of 4932	3016	b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe	b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe
PID 3016 wrote to memory of 4932	3016	b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe	b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe
PID 3016 wrote to memory of 4932	3016	b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe	b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe

C:\Users\Admin\AppData\Local\Temp\b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe
"C:\Users\Admin\AppData\Local\Temp\b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3016

C:\Users\Admin\AppData\Local\Temp\b3f0119501641ea5f3fca5c1197f98c1734071b3d12416cf770944c9a9f4a5de.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4932-132-0x0000000000000000-mapping.dmp

Download
memory/4932-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4932-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4932-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4932-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4932-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4932-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download