93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481

Analysis

max time kernel
152s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe
Size

1.3MB
MD5

8b8a00ebc16404807a319f1334506e4b
SHA1

3ccfe69b8477bd2161298922b2943dee9153b863
SHA256

93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481
SHA512

9c6b6a4cef5b76eabde1370c835c2f1145f67b240e3e936d21dfb40332f542981be295fc4b3af73e7092050357ba101b83775f47d078bd3cbf199720539cf38d
SSDEEP

24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak+:jrKo4ZwCOnYjVmJPaJ

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe

description	pid	process	target process
PID 396 set thread context of 2240	396	93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe	93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe

pid	process
2240	93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe
2240	93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe
2240	93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe
2240	93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe
2240	93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe

description	pid	process	target process
PID 396 wrote to memory of 2240	396	93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe	93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe
PID 396 wrote to memory of 2240	396	93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe	93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe
PID 396 wrote to memory of 2240	396	93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe	93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe
PID 396 wrote to memory of 2240	396	93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe	93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe
PID 396 wrote to memory of 2240	396	93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe	93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe
PID 396 wrote to memory of 2240	396	93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe	93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe
PID 396 wrote to memory of 2240	396	93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe	93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe
PID 396 wrote to memory of 2240	396	93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe	93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe
PID 396 wrote to memory of 2240	396	93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe	93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe
PID 396 wrote to memory of 2240	396	93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe	93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe

C:\Users\Admin\AppData\Local\Temp\93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe
"C:\Users\Admin\AppData\Local\Temp\93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:396
- C:\Users\Admin\AppData\Local\Temp\93186c50c4df7b9563da582a9fec375279d552fb4a9dc060c8c0b318ad7aa481.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2240-132-0x0000000000000000-mapping.dmp

Download
memory/2240-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2240-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2240-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2240-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2240-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download