9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d

Analysis

max time kernel
146s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe
Size

1.3MB
MD5

f1d94e3cd3fdf8bfe571175f7a8a7648
SHA1

44fef7edcc705c9e0119626a368dfa1db782b440
SHA256

9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d
SHA512

9a40c691ba2c246d44ae352636f61a9b616cdb98738fe7c19ba35b2aa263b7745e55ae74cb87bc8958e0d9aea82d64cb099c8e05e1c5312ae8edd4ad22b13820
SSDEEP

24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakO:jrKo4ZwCOnYjVmJPa9

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe

description	pid	process	target process
PID 2960 set thread context of 2580	2960	9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe	9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe

pid	process
2580	9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe
2580	9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe
2580	9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe
2580	9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe
2580	9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe

description	pid	process	target process
PID 2960 wrote to memory of 2580	2960	9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe	9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe
PID 2960 wrote to memory of 2580	2960	9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe	9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe
PID 2960 wrote to memory of 2580	2960	9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe	9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe
PID 2960 wrote to memory of 2580	2960	9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe	9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe
PID 2960 wrote to memory of 2580	2960	9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe	9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe
PID 2960 wrote to memory of 2580	2960	9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe	9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe
PID 2960 wrote to memory of 2580	2960	9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe	9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe
PID 2960 wrote to memory of 2580	2960	9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe	9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe
PID 2960 wrote to memory of 2580	2960	9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe	9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe
PID 2960 wrote to memory of 2580	2960	9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe	9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe

C:\Users\Admin\AppData\Local\Temp\9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe
"C:\Users\Admin\AppData\Local\Temp\9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2960

C:\Users\Admin\AppData\Local\Temp\9524c97e344925bafb589989fcc9a62881208eeb0fe45530a9f55ab6087dfd2d.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:2580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2580-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2580-132-0x0000000000000000-mapping.dmp

Download
memory/2580-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2580-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2580-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2580-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download