8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5

Analysis

max time kernel
187s
max time network
219s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe
Size

1.6MB
MD5

dc425aaa3cb0dc7998e21aad85c3d6e0
SHA1

262ae1cf5ff2717b408c97304aad8a7fa5dec9d8
SHA256

8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5
SHA512

273db5109c750959e6d255db5e68c32e400f201a5e1b6a414d1c7fa3e3928e240bd1ff0b0e6439724db01a9131c54c3861f21eed38d94fe71cd1dc1f508d6a0d
SSDEEP

24576:xzD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUYB:D6/ye0PIphrp9Zuvjqa0Uidi

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe

description	pid	process	target process
PID 1860 set thread context of 204	1860	8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe	8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe

pid	process
204	8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe
204	8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe
204	8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe
204	8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe
204	8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe

description	pid	process	target process
PID 1860 wrote to memory of 204	1860	8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe	8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe
PID 1860 wrote to memory of 204	1860	8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe	8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe
PID 1860 wrote to memory of 204	1860	8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe	8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe
PID 1860 wrote to memory of 204	1860	8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe	8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe
PID 1860 wrote to memory of 204	1860	8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe	8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe
PID 1860 wrote to memory of 204	1860	8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe	8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe
PID 1860 wrote to memory of 204	1860	8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe	8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe
PID 1860 wrote to memory of 204	1860	8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe	8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe
PID 1860 wrote to memory of 204	1860	8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe	8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe
PID 1860 wrote to memory of 204	1860	8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe	8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe

C:\Users\Admin\AppData\Local\Temp\8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe
"C:\Users\Admin\AppData\Local\Temp\8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1860

C:\Users\Admin\AppData\Local\Temp\8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe
"C:\Users\Admin\AppData\Local\Temp\8db4e5f6368738482d4aca8b648c22f60cf5095d076e12e7bc4faa617710c6f5.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/204-132-0x0000000000000000-mapping.dmp

Download
memory/204-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/204-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/204-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/204-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/204-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/204-138-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download