af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93

Analysis

max time kernel
91s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe
Size

1.3MB
MD5

506b55af563e352deefa3d168df402d4
SHA1

18751d0858343b660c74083ce3ec6afc03ece50a
SHA256

af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93
SHA512

2b0f3cc8b89a92bba675f0e32b16fb39e61fe3f17f00617e3968e40c9a286140a5eda26659e111efd5238106d3f755ce68e27d2fd346ae73f3cb0d539e021d68
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakW:TrKo4ZwCOnYjVmJPa5

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe

description	pid	process	target process
PID 616 set thread context of 4100	616	af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe	af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe

pid	process
4100	af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe
4100	af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe
4100	af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe
4100	af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe
4100	af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe

description	pid	process	target process
PID 616 wrote to memory of 4100	616	af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe	af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe
PID 616 wrote to memory of 4100	616	af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe	af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe
PID 616 wrote to memory of 4100	616	af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe	af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe
PID 616 wrote to memory of 4100	616	af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe	af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe
PID 616 wrote to memory of 4100	616	af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe	af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe
PID 616 wrote to memory of 4100	616	af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe	af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe
PID 616 wrote to memory of 4100	616	af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe	af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe
PID 616 wrote to memory of 4100	616	af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe	af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe
PID 616 wrote to memory of 4100	616	af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe	af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe
PID 616 wrote to memory of 4100	616	af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe	af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe

C:\Users\Admin\AppData\Local\Temp\af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe
"C:\Users\Admin\AppData\Local\Temp\af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:616

C:\Users\Admin\AppData\Local\Temp\af5572d9628bb4e4cb65e78904da7f013028de75b007501126ebdf86b82e4e93.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4100-132-0x0000000000000000-mapping.dmp

Download
memory/4100-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4100-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4100-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4100-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4100-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4100-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download