91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671

Analysis

max time kernel
159s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe
Size

1.3MB
MD5

171300457738ce5903fabb1a6049c936
SHA1

47af02541e74684d1b3bce98e391a112c46e39ce
SHA256

91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671
SHA512

9312b2e497bce09622aa61f512d557ecd6a6ec2d1e936e16fe37028af911e3fc96a5a4675098da6e19b37fffa54f5e75eb03a4d743478c550f0ed2f6d2e78896
SSDEEP

24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakl:jrKo4ZwCOnYjVmJPam

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe

description	pid	process	target process
PID 4280 set thread context of 884	4280	91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe	91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe

pid	process
884	91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe
884	91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe
884	91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe
884	91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe
884	91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe

description	pid	process	target process
PID 4280 wrote to memory of 884	4280	91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe	91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe
PID 4280 wrote to memory of 884	4280	91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe	91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe
PID 4280 wrote to memory of 884	4280	91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe	91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe
PID 4280 wrote to memory of 884	4280	91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe	91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe
PID 4280 wrote to memory of 884	4280	91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe	91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe
PID 4280 wrote to memory of 884	4280	91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe	91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe
PID 4280 wrote to memory of 884	4280	91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe	91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe
PID 4280 wrote to memory of 884	4280	91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe	91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe
PID 4280 wrote to memory of 884	4280	91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe	91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe
PID 4280 wrote to memory of 884	4280	91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe	91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe

C:\Users\Admin\AppData\Local\Temp\91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe
"C:\Users\Admin\AppData\Local\Temp\91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4280

C:\Users\Admin\AppData\Local\Temp\91d6f91c5ef1ecff5bbd6bb8146cb638ba47b46ef6dc69d6f600fabccce79671.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/884-132-0x0000000000000000-mapping.dmp

Download
memory/884-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/884-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/884-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/884-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/884-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download