a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe
Size

1.6MB
MD5

a7d540b324241e1acc8e415efea057c4
SHA1

bef0174f207e80edc1656082db9da7070cdf443a
SHA256

a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50
SHA512

2bff334d767fa41df18b2e52778643a088d5bf8b7eb051192d8d8c1d0d76feac843da861756b0eb487f51e49adeafdb76ccdc9b6470b589aec94007806597552
SSDEEP

24576:9zD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUYw:X6/ye0PIphrp9Zuvjqa0Uidb

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe

description	pid	process	target process
PID 4976 set thread context of 1044	4976	a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe	a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe

pid	process
1044	a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe
1044	a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe
1044	a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe
1044	a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe
1044	a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe

description	pid	process	target process
PID 4976 wrote to memory of 1044	4976	a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe	a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe
PID 4976 wrote to memory of 1044	4976	a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe	a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe
PID 4976 wrote to memory of 1044	4976	a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe	a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe
PID 4976 wrote to memory of 1044	4976	a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe	a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe
PID 4976 wrote to memory of 1044	4976	a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe	a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe
PID 4976 wrote to memory of 1044	4976	a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe	a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe
PID 4976 wrote to memory of 1044	4976	a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe	a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe
PID 4976 wrote to memory of 1044	4976	a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe	a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe
PID 4976 wrote to memory of 1044	4976	a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe	a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe
PID 4976 wrote to memory of 1044	4976	a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe	a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe

C:\Users\Admin\AppData\Local\Temp\a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe
"C:\Users\Admin\AppData\Local\Temp\a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Users\Admin\AppData\Local\Temp\a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe
  "C:\Users\Admin\AppData\Local\Temp\a9b533334503747d7e8a9604a949e8fd4b6f30483388df351e4e86e4a7096f50.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1044-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1044-132-0x0000000000000000-mapping.dmp

Download
memory/1044-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1044-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1044-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1044-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download