8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880

Analysis

max time kernel
186s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe
Size

1.3MB
MD5

5b54c485761156b1610cb2e6e4f8bcd1
SHA1

01e4e5c173312644d7ec89f571ceab7b45424655
SHA256

8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880
SHA512

e136f9d38450eddd2b8856d652631140522e4b4267617a5bd338e78f90f208e3aeb8885d2596676c4ef64e1699064f7bc3ff5238c935530a8728d81df1b2b70b
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPaki:zrKo4ZwCOnYjVmJPa5

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe

description	pid	process	target process
PID 1404 set thread context of 3908	1404	8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe	8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe

pid	process
3908	8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe
3908	8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe
3908	8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe
3908	8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe
3908	8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe

description	pid	process	target process
PID 1404 wrote to memory of 3908	1404	8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe	8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe
PID 1404 wrote to memory of 3908	1404	8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe	8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe
PID 1404 wrote to memory of 3908	1404	8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe	8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe
PID 1404 wrote to memory of 3908	1404	8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe	8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe
PID 1404 wrote to memory of 3908	1404	8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe	8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe
PID 1404 wrote to memory of 3908	1404	8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe	8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe
PID 1404 wrote to memory of 3908	1404	8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe	8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe
PID 1404 wrote to memory of 3908	1404	8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe	8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe
PID 1404 wrote to memory of 3908	1404	8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe	8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe
PID 1404 wrote to memory of 3908	1404	8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe	8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe

C:\Users\Admin\AppData\Local\Temp\8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe
"C:\Users\Admin\AppData\Local\Temp\8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1404

C:\Users\Admin\AppData\Local\Temp\8987a535ae118d87825716ef0b754e9543db91b1d2742aa315d66355092c6880.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:3908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3908-132-0x0000000000000000-mapping.dmp

Download
memory/3908-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3908-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3908-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3908-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3908-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download