aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976

Analysis

max time kernel
167s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe
Size

1.3MB
MD5

2e5c13b990e28a4101d70dbbd3cf36e6
SHA1

0e7a1e18df0aa338252fa030e5ecfaebc1c4b0e9
SHA256

aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976
SHA512

54f92b46f20db37a4a05b0f259426528a33a10a959d79f8f4bb232ad160cb36a5733012ae248e2384483d888955f4c8e6f180e42c27c00ce322340ba6455ff06
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak5:zrKo4ZwCOnYjVmJPaW

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe

description	pid	process	target process
PID 4776 set thread context of 5088	4776	aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe	aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe

pid	process
5088	aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe
5088	aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe
5088	aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe
5088	aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe
5088	aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe

description	pid	process	target process
PID 4776 wrote to memory of 5088	4776	aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe	aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe
PID 4776 wrote to memory of 5088	4776	aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe	aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe
PID 4776 wrote to memory of 5088	4776	aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe	aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe
PID 4776 wrote to memory of 5088	4776	aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe	aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe
PID 4776 wrote to memory of 5088	4776	aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe	aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe
PID 4776 wrote to memory of 5088	4776	aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe	aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe
PID 4776 wrote to memory of 5088	4776	aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe	aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe
PID 4776 wrote to memory of 5088	4776	aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe	aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe
PID 4776 wrote to memory of 5088	4776	aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe	aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe
PID 4776 wrote to memory of 5088	4776	aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe	aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe

C:\Users\Admin\AppData\Local\Temp\aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe
"C:\Users\Admin\AppData\Local\Temp\aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4776

C:\Users\Admin\AppData\Local\Temp\aa76bd307a71f59b0e039f04088152ca678c4f22c188f147e510f9bd8dd1e976.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:5088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5088-132-0x0000000000000000-mapping.dmp

Download
memory/5088-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/5088-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/5088-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/5088-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/5088-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download