962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7

Analysis

max time kernel
84s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe
Size

1.3MB
MD5

7f8ddefa9bce311d7cb5ad66e0dcd202
SHA1

c2ce4fd56c16b699bfa66f5db3789e067e635c65
SHA256

962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7
SHA512

100be892cad1f622f32e0a707003ab0af5eeb7686e2c077d431d28e291b22129df21040fdcab7a949682435c4b5de61740fd311059e345f26a956acab8b9c19e
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPaka:TrKo4ZwCOnYjVmJPaJ

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe

description	pid	process	target process
PID 1092 set thread context of 2224	1092	962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe	962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe

pid	process
2224	962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe
2224	962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe
2224	962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe
2224	962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe
2224	962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe

description	pid	process	target process
PID 1092 wrote to memory of 2224	1092	962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe	962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe
PID 1092 wrote to memory of 2224	1092	962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe	962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe
PID 1092 wrote to memory of 2224	1092	962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe	962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe
PID 1092 wrote to memory of 2224	1092	962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe	962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe
PID 1092 wrote to memory of 2224	1092	962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe	962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe
PID 1092 wrote to memory of 2224	1092	962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe	962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe
PID 1092 wrote to memory of 2224	1092	962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe	962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe
PID 1092 wrote to memory of 2224	1092	962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe	962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe
PID 1092 wrote to memory of 2224	1092	962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe	962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe
PID 1092 wrote to memory of 2224	1092	962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe	962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe

C:\Users\Admin\AppData\Local\Temp\962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe
"C:\Users\Admin\AppData\Local\Temp\962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1092

C:\Users\Admin\AppData\Local\Temp\962ae90d5293ddf446d16df0818ee53753e08cbf327bec27aa0239de67f7c2a7.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:2224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2224-132-0x0000000000000000-mapping.dmp

Download
memory/2224-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2224-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2224-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2224-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2224-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2224-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download