92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179

Analysis

max time kernel
153s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe
Size

1.3MB
MD5

7fc2679a6064b42b1931b569113d012e
SHA1

18d08fbbd6e25e9c24d94c7f76696b11da343dc7
SHA256

92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179
SHA512

ff35a2968d8f635daef891dda50d0dc3bcab726b3c2ddbbfc9287cefcefda008d4aca759c64035093697beb24cbbdc78353e15a69cebeff961a258536d6468b5
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak:TrKo4ZwCOnYjVmJPa

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe

description	pid	process	target process
PID 2076 set thread context of 1840	2076	92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe	92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe

pid	process
1840	92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe
1840	92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe
1840	92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe
1840	92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe
1840	92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe

description	pid	process	target process
PID 2076 wrote to memory of 1840	2076	92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe	92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe
PID 2076 wrote to memory of 1840	2076	92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe	92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe
PID 2076 wrote to memory of 1840	2076	92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe	92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe
PID 2076 wrote to memory of 1840	2076	92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe	92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe
PID 2076 wrote to memory of 1840	2076	92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe	92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe
PID 2076 wrote to memory of 1840	2076	92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe	92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe
PID 2076 wrote to memory of 1840	2076	92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe	92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe
PID 2076 wrote to memory of 1840	2076	92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe	92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe
PID 2076 wrote to memory of 1840	2076	92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe	92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe
PID 2076 wrote to memory of 1840	2076	92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe	92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe

C:\Users\Admin\AppData\Local\Temp\92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe
"C:\Users\Admin\AppData\Local\Temp\92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2076

C:\Users\Admin\AppData\Local\Temp\92a0a9198682bd836abc5b1cf81d7a9d1535424d58c577a607be3fc952b3a179.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:1840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1840-132-0x0000000000000000-mapping.dmp

Download
memory/1840-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1840-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1840-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1840-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1840-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download