ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41

Analysis

max time kernel
157s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe
Size

1.3MB
MD5

4105dc15796dd6e237c86e6b11f3b8c4
SHA1

8687139ae17f6b3bc69bf4b07ba4e4b62221e769
SHA256

ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41
SHA512

05fb4145f2d26a52573ed018c63ba2db3a2ac79a5ccef01da1c0a0b0ec54a270195abd5a0541bb7f9fdf92e633fc7a47ab0695314f70bb829dbad42aa495d1dd
SSDEEP

24576:JDASdSysJOcj0VQpWbl7s2LP0CXuiAayiWASALUgv2j6R6XEVeRs9HgVfgqk:OSQtk2zQytkgis6yxnk

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe

description	pid	process	target process
PID 1956 set thread context of 380	1956	ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe	ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe

pid	process
380	ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe
380	ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe
380	ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe
380	ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe
380	ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe

description	pid	process	target process
PID 1956 wrote to memory of 380	1956	ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe	ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe
PID 1956 wrote to memory of 380	1956	ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe	ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe
PID 1956 wrote to memory of 380	1956	ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe	ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe
PID 1956 wrote to memory of 380	1956	ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe	ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe
PID 1956 wrote to memory of 380	1956	ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe	ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe
PID 1956 wrote to memory of 380	1956	ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe	ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe
PID 1956 wrote to memory of 380	1956	ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe	ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe
PID 1956 wrote to memory of 380	1956	ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe	ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe
PID 1956 wrote to memory of 380	1956	ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe	ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe
PID 1956 wrote to memory of 380	1956	ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe	ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe

C:\Users\Admin\AppData\Local\Temp\ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe
"C:\Users\Admin\AppData\Local\Temp\ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1956

C:\Users\Admin\AppData\Local\Temp\ae231f4508a91754334a7716d76f2609fd8f5300daea7450817d0157a912fc41.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/380-132-0x0000000000000000-mapping.dmp

Download
memory/380-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/380-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/380-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/380-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/380-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download