78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe
Size

1.3MB
MD5

8444405f7dae69b01ba43613bf57234a
SHA1

b0886dcc83f256ed7da8eb7d239bdda33c9148e8
SHA256

78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb
SHA512

156cf086f1b0774741f52ea04aa7bfa63d162b10f0508e501f9e013aae6ce7db0216d50870df70c15b6ef207744f3f8313fc505acb34219c5161b42509dea7cd
SSDEEP

24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakB:jrKo4ZwCOnYjVmJPae

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe

description	pid	process	target process
PID 4228 set thread context of 2660	4228	78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe	78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe

pid	process
2660	78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe
2660	78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe
2660	78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe
2660	78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe
2660	78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe

description	pid	process	target process
PID 4228 wrote to memory of 2660	4228	78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe	78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe
PID 4228 wrote to memory of 2660	4228	78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe	78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe
PID 4228 wrote to memory of 2660	4228	78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe	78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe
PID 4228 wrote to memory of 2660	4228	78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe	78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe
PID 4228 wrote to memory of 2660	4228	78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe	78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe
PID 4228 wrote to memory of 2660	4228	78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe	78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe
PID 4228 wrote to memory of 2660	4228	78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe	78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe
PID 4228 wrote to memory of 2660	4228	78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe	78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe
PID 4228 wrote to memory of 2660	4228	78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe	78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe
PID 4228 wrote to memory of 2660	4228	78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe	78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe

C:\Users\Admin\AppData\Local\Temp\78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe
"C:\Users\Admin\AppData\Local\Temp\78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4228

C:\Users\Admin\AppData\Local\Temp\78c9fcbd50dfbe13ff44127a6af9890a993f59cb4653f3f578e8a846d4ddf0fb.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:2660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2660-132-0x0000000000000000-mapping.dmp

Download
memory/2660-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2660-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2660-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2660-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download