afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe
Size

1.3MB
MD5

74a30596e002bb67b6b0efd1915faa71
SHA1

81e462bec9bd0cb67c150e1a6196177dd64c261c
SHA256

afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf
SHA512

eb4d6bd89e206b682f8c16d59bb9faa3fc18aa2381e6760dcbeb049898bc174cc7b0b78a5ed05f0a086b9dd9ecf5a5030f3111f1114bda9b1e64fdb63316b5a2
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakT:7rKo4ZwCOnYjVmJPa8

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe

description	pid	process	target process
PID 4428 set thread context of 4820	4428	afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe	afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe

pid	process
4820	afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe
4820	afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe
4820	afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe
4820	afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe
4820	afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe

description	pid	process	target process
PID 4428 wrote to memory of 4820	4428	afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe	afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe
PID 4428 wrote to memory of 4820	4428	afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe	afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe
PID 4428 wrote to memory of 4820	4428	afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe	afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe
PID 4428 wrote to memory of 4820	4428	afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe	afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe
PID 4428 wrote to memory of 4820	4428	afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe	afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe
PID 4428 wrote to memory of 4820	4428	afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe	afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe
PID 4428 wrote to memory of 4820	4428	afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe	afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe
PID 4428 wrote to memory of 4820	4428	afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe	afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe
PID 4428 wrote to memory of 4820	4428	afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe	afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe
PID 4428 wrote to memory of 4820	4428	afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe	afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe

C:\Users\Admin\AppData\Local\Temp\afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe
"C:\Users\Admin\AppData\Local\Temp\afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4428

C:\Users\Admin\AppData\Local\Temp\afe219a9b181e3d3fe3e3417f6809c996967d3dff95f980833669d2d3442acdf.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4820-132-0x0000000000000000-mapping.dmp

Download
memory/4820-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4820-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4820-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4820-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4820-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4820-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download