8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51

Analysis

max time kernel
318s
max time network
376s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe
Size

1.3MB
MD5

2f53d4db1138800ac4f30c4a0a40bdc5
SHA1

67fe7872e682ef9d3c059a468ac345030d10a547
SHA256

8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51
SHA512

914afd0c1f8b4b397c23feab0759d7cf84cac045009e50d32bc49b692ae1a8b6f301526885029caa9c1f2425bb34655999e87a3ea364e3588dea072c94046059
SSDEEP

24576:nOiZzDXGLFP53UG7bL1HohIE6BvRx0GOb/4+a0q3bhAqtxe9Uv:Oi1DWLFP53UGe76x0ZUphdtpv

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe

description	pid	process	target process
PID 2912 set thread context of 4104	2912	8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe	8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe

pid	process
4104	8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe
4104	8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe
4104	8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe
4104	8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe
4104	8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe

description	pid	process	target process
PID 2912 wrote to memory of 4104	2912	8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe	8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe
PID 2912 wrote to memory of 4104	2912	8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe	8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe
PID 2912 wrote to memory of 4104	2912	8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe	8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe
PID 2912 wrote to memory of 4104	2912	8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe	8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe
PID 2912 wrote to memory of 4104	2912	8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe	8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe
PID 2912 wrote to memory of 4104	2912	8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe	8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe
PID 2912 wrote to memory of 4104	2912	8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe	8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe
PID 2912 wrote to memory of 4104	2912	8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe	8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe
PID 2912 wrote to memory of 4104	2912	8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe	8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe
PID 2912 wrote to memory of 4104	2912	8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe	8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe

C:\Users\Admin\AppData\Local\Temp\8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe
"C:\Users\Admin\AppData\Local\Temp\8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2912

C:\Users\Admin\AppData\Local\Temp\8da972e15cb31d9e57a9445a310fd2b3e4688ae36cfd4638f6ee6b218098fc51.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4104-132-0x0000000000000000-mapping.dmp

Download
memory/4104-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4104-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4104-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4104-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4104-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download