8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146

Analysis

max time kernel
185s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe
Size

1.3MB
MD5

46c44b66ac72286d262ce7d3b90e6556
SHA1

6e915fc7552ee66017829a141714a4f438e821b0
SHA256

8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146
SHA512

ab277e59095d4fd17a1bdfb924446450f94cd4093e28b46a6ad574497e3749139c7e768fcf68f799bce5d5f2ca08c40034c1a9c051e4fb2c5d1f393ced32aa40
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakl:7rKo4ZwCOnYjVmJPaW

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe

description	pid	process	target process
PID 3400 set thread context of 1008	3400	8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe	8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe

pid	process
1008	8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe
1008	8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe
1008	8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe
1008	8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe
1008	8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe

description	pid	process	target process
PID 3400 wrote to memory of 1008	3400	8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe	8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe
PID 3400 wrote to memory of 1008	3400	8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe	8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe
PID 3400 wrote to memory of 1008	3400	8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe	8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe
PID 3400 wrote to memory of 1008	3400	8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe	8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe
PID 3400 wrote to memory of 1008	3400	8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe	8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe
PID 3400 wrote to memory of 1008	3400	8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe	8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe
PID 3400 wrote to memory of 1008	3400	8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe	8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe
PID 3400 wrote to memory of 1008	3400	8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe	8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe
PID 3400 wrote to memory of 1008	3400	8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe	8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe
PID 3400 wrote to memory of 1008	3400	8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe	8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe

C:\Users\Admin\AppData\Local\Temp\8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe
"C:\Users\Admin\AppData\Local\Temp\8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3400

C:\Users\Admin\AppData\Local\Temp\8e461d252f36317413a3acc6d7fb73b798492c6f4b3723ebdf7c3ea2a68dc146.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:1008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1008-132-0x0000000000000000-mapping.dmp

Download
memory/1008-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1008-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1008-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1008-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1008-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1008-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download