96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb

Analysis

max time kernel
69s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe
Size

1.3MB
MD5

3a2ed76f8eef7f983b01b053bd761f45
SHA1

32e06d28c7658d03890d9cb13d74b6a02e344d83
SHA256

96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb
SHA512

0a70788ebe9cbfd46962b1e760460c9c3ae833b69d262068123e8d04154349dcc62082eafeb110ba0ed752af32bb49f07816d82120528c7dee97baa464688d44
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak/:zrKo4ZwCOnYjVmJPao

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe

description	pid	process	target process
PID 1368 set thread context of 3412	1368	96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe	96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe

pid	process
3412	96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe
3412	96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe
3412	96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe
3412	96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe
3412	96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe

description	pid	process	target process
PID 1368 wrote to memory of 3412	1368	96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe	96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe
PID 1368 wrote to memory of 3412	1368	96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe	96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe
PID 1368 wrote to memory of 3412	1368	96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe	96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe
PID 1368 wrote to memory of 3412	1368	96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe	96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe
PID 1368 wrote to memory of 3412	1368	96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe	96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe
PID 1368 wrote to memory of 3412	1368	96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe	96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe
PID 1368 wrote to memory of 3412	1368	96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe	96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe
PID 1368 wrote to memory of 3412	1368	96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe	96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe
PID 1368 wrote to memory of 3412	1368	96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe	96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe
PID 1368 wrote to memory of 3412	1368	96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe	96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe

C:\Users\Admin\AppData\Local\Temp\96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe
"C:\Users\Admin\AppData\Local\Temp\96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1368

C:\Users\Admin\AppData\Local\Temp\96ddd1b6444ab063133a6354983e4923cd8390d9329b33a576ca7ef941cb0ddb.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:3412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3412-132-0x0000000000000000-mapping.dmp

Download
memory/3412-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3412-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3412-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3412-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3412-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download