a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe
Size

1.3MB
MD5

434cde932b07acae06bb6890dc6f0905
SHA1

4102922af875dab973823dbeffc041c469de1657
SHA256

a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb
SHA512

eb2d042b689461095ec134ac5b38a38a753cc4a016f917ef14b58cd517a07f1242a3583acf344257dcf3673896f6f1ca7885cc4051fd46b81b7b2d2a4a675188
SSDEEP

24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakf:jrKo4ZwCOnYjVmJPaY

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe

description	pid	process	target process
PID 4856 set thread context of 2692	4856	a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe	a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe

pid	process
2692	a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe
2692	a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe
2692	a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe
2692	a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe
2692	a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe

description	pid	process	target process
PID 4856 wrote to memory of 2692	4856	a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe	a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe
PID 4856 wrote to memory of 2692	4856	a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe	a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe
PID 4856 wrote to memory of 2692	4856	a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe	a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe
PID 4856 wrote to memory of 2692	4856	a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe	a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe
PID 4856 wrote to memory of 2692	4856	a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe	a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe
PID 4856 wrote to memory of 2692	4856	a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe	a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe
PID 4856 wrote to memory of 2692	4856	a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe	a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe
PID 4856 wrote to memory of 2692	4856	a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe	a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe
PID 4856 wrote to memory of 2692	4856	a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe	a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe
PID 4856 wrote to memory of 2692	4856	a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe	a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe

C:\Users\Admin\AppData\Local\Temp\a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe
"C:\Users\Admin\AppData\Local\Temp\a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4856

C:\Users\Admin\AppData\Local\Temp\a57fac901eff171aee673fb7cb76fb220b5b8f89b17d4029f8674c9b4cc74ebb.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:2692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2692-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2692-132-0x0000000000000000-mapping.dmp

Download
memory/2692-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2692-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2692-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2692-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download