94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45

Analysis

max time kernel
73s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe
Size

1.3MB
MD5

32786e9e9bbdb621f669cd50dd41415e
SHA1

003197ef463420f57f394f844efc0faa1db2cd2e
SHA256

94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45
SHA512

59b725161ccb22bebcfb70d21d1adfb5983edcb21d55cf170a0149e2ab6ab1ad1938bdad2cde014956a397e4da6293d2185528e885940ac8ed9269baba1bec6a
SSDEEP

24576:rrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak:rrKo4ZwCOnYjVmJPa

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe

description	pid	process	target process
PID 3108 set thread context of 4480	3108	94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe	94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe

pid	process
4480	94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe
4480	94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe
4480	94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe
4480	94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe
4480	94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe

description	pid	process	target process
PID 3108 wrote to memory of 4480	3108	94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe	94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe
PID 3108 wrote to memory of 4480	3108	94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe	94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe
PID 3108 wrote to memory of 4480	3108	94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe	94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe
PID 3108 wrote to memory of 4480	3108	94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe	94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe
PID 3108 wrote to memory of 4480	3108	94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe	94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe
PID 3108 wrote to memory of 4480	3108	94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe	94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe
PID 3108 wrote to memory of 4480	3108	94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe	94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe
PID 3108 wrote to memory of 4480	3108	94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe	94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe
PID 3108 wrote to memory of 4480	3108	94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe	94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe
PID 3108 wrote to memory of 4480	3108	94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe	94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe

C:\Users\Admin\AppData\Local\Temp\94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe
"C:\Users\Admin\AppData\Local\Temp\94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3108

C:\Users\Admin\AppData\Local\Temp\94a6e6f1b04cad6693021437d80bdb2404d6ba91fcdd997706f989adcdea0e45.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4480-132-0x0000000000000000-mapping.dmp

Download
memory/4480-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4480-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4480-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4480-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4480-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download