94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db

Analysis

max time kernel
300s
max time network
326s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe
Size

1.3MB
MD5

91aedbe3d2b29692d5d3cda77fd90b3e
SHA1

b3c131976227573e82f42d64bea69f170c709160
SHA256

94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db
SHA512

15f04aff0a3fe494edccc79f544dc2544baf597f9a68688301e6901602666d5e5efd69955d1fc8b34bfd7e4b118aeb1b56df1e413ff6c4bec3cd2ff6d796e85b
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakE:7rKo4ZwCOnYjVmJPaL

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe

description	pid	process	target process
PID 4612 set thread context of 2992	4612	94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe	94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe

pid	process
2992	94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe
2992	94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe
2992	94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe
2992	94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe
2992	94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe

description	pid	process	target process
PID 4612 wrote to memory of 2992	4612	94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe	94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe
PID 4612 wrote to memory of 2992	4612	94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe	94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe
PID 4612 wrote to memory of 2992	4612	94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe	94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe
PID 4612 wrote to memory of 2992	4612	94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe	94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe
PID 4612 wrote to memory of 2992	4612	94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe	94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe
PID 4612 wrote to memory of 2992	4612	94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe	94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe
PID 4612 wrote to memory of 2992	4612	94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe	94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe
PID 4612 wrote to memory of 2992	4612	94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe	94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe
PID 4612 wrote to memory of 2992	4612	94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe	94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe
PID 4612 wrote to memory of 2992	4612	94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe	94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe

C:\Users\Admin\AppData\Local\Temp\94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe
"C:\Users\Admin\AppData\Local\Temp\94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Users\Admin\AppData\Local\Temp\94d7877c5e71383b5593e2e62faf6d664d10371a4add2a7037e39e74879c00db.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2992-132-0x0000000000000000-mapping.dmp

Download
memory/2992-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2992-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2992-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2992-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download