a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d

Analysis

max time kernel
137s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe
Size

1.3MB
MD5

719b8d213145a73fb51bb7f960352adf
SHA1

cc71aaf3d43d0931695fb833433f1d77a94d2a5b
SHA256

a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d
SHA512

ee6421be450641f8a38c032846d9962e80b7b05cc51d5e0f031875c7709919ce0dd5822b0e9bf4b915348b269db7a5b04d3a2c4fc6a7186b8e99e814d37a37ea
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak:7rKo4ZwCOnYjVmJPa

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe

description	pid	process	target process
PID 1300 set thread context of 3068	1300	a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe	a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe

pid	process
3068	a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe
3068	a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe
3068	a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe
3068	a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe
3068	a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe

description	pid	process	target process
PID 1300 wrote to memory of 3068	1300	a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe	a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe
PID 1300 wrote to memory of 3068	1300	a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe	a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe
PID 1300 wrote to memory of 3068	1300	a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe	a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe
PID 1300 wrote to memory of 3068	1300	a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe	a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe
PID 1300 wrote to memory of 3068	1300	a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe	a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe
PID 1300 wrote to memory of 3068	1300	a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe	a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe
PID 1300 wrote to memory of 3068	1300	a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe	a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe
PID 1300 wrote to memory of 3068	1300	a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe	a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe
PID 1300 wrote to memory of 3068	1300	a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe	a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe
PID 1300 wrote to memory of 3068	1300	a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe	a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe

C:\Users\Admin\AppData\Local\Temp\a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe
"C:\Users\Admin\AppData\Local\Temp\a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1300

C:\Users\Admin\AppData\Local\Temp\a62ea2b1819213e10ab0db718bcfd697e99c36517fa2321d8c6a8d8e570f6f9d.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:3068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3068-132-0x0000000000000000-mapping.dmp

Download
memory/3068-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3068-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3068-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3068-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3068-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3068-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download