afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678

Analysis

max time kernel
175s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe
Size

1.6MB
MD5

6c862be6652038ee9366ce3efa4b2090
SHA1

98aa1c6ea28d5394871defeaee5efd1cca75331d
SHA256

afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678
SHA512

977d43cf083e78d7bceeacca1db33d698f04b871f702ee1db11facf292c14fd2363b99cd6a8af0ae90c5418b34100ea628ce62ffed95cf5d8bc2b453dcb11ccb
SSDEEP

24576:9zD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUY8:X6/ye0PIphrp9Zuvjqa0Uidb

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe

description	pid	process	target process
PID 4456 set thread context of 620	4456	afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe	afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe

pid	process
620	afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe
620	afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe
620	afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe
620	afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe
620	afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe

description	pid	process	target process
PID 4456 wrote to memory of 620	4456	afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe	afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe
PID 4456 wrote to memory of 620	4456	afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe	afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe
PID 4456 wrote to memory of 620	4456	afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe	afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe
PID 4456 wrote to memory of 620	4456	afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe	afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe
PID 4456 wrote to memory of 620	4456	afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe	afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe
PID 4456 wrote to memory of 620	4456	afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe	afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe
PID 4456 wrote to memory of 620	4456	afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe	afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe
PID 4456 wrote to memory of 620	4456	afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe	afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe
PID 4456 wrote to memory of 620	4456	afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe	afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe
PID 4456 wrote to memory of 620	4456	afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe	afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe

C:\Users\Admin\AppData\Local\Temp\afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe
"C:\Users\Admin\AppData\Local\Temp\afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4456

C:\Users\Admin\AppData\Local\Temp\afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe
"C:\Users\Admin\AppData\Local\Temp\afb25223fba59e3ca95527eb13c0b2bc0a4ab54a89d08829b7a51bbd16182678.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/620-133-0x0000000000000000-mapping.dmp

Download
memory/620-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/620-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/620-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/620-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/620-138-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download