87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252

Analysis

max time kernel
319s
max time network
375s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe
Size

1.3MB
MD5

461b908e5ed254f6980c27daf4a70227
SHA1

6a446dd4bc8acffe494c96f130c28bd58c169d47
SHA256

87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252
SHA512

d6f6fe37fc13fbe1e45eb4cfa80d858cb575bd09d05f34334924108a1f4293a98ee5840d8ef751bce3aa8e3df2039c22f2617b144d9e6bedc9423f734cf942d2
SSDEEP

24576:rrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak:rrKo4ZwCOnYjVmJPa

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe

description	pid	process	target process
PID 2432 set thread context of 2564	2432	87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe	87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe

pid	process
2564	87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe
2564	87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe
2564	87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe
2564	87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe
2564	87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe

description	pid	process	target process
PID 2432 wrote to memory of 2564	2432	87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe	87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe
PID 2432 wrote to memory of 2564	2432	87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe	87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe
PID 2432 wrote to memory of 2564	2432	87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe	87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe
PID 2432 wrote to memory of 2564	2432	87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe	87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe
PID 2432 wrote to memory of 2564	2432	87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe	87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe
PID 2432 wrote to memory of 2564	2432	87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe	87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe
PID 2432 wrote to memory of 2564	2432	87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe	87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe
PID 2432 wrote to memory of 2564	2432	87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe	87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe
PID 2432 wrote to memory of 2564	2432	87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe	87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe
PID 2432 wrote to memory of 2564	2432	87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe	87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe

C:\Users\Admin\AppData\Local\Temp\87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe
"C:\Users\Admin\AppData\Local\Temp\87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2432

C:\Users\Admin\AppData\Local\Temp\87b82bd64b48da825010b07281ca51604f8e9cf57c000990ef6e2e3b223b9252.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:2564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2564-132-0x0000000000000000-mapping.dmp

Download
memory/2564-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2564-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2564-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2564-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2564-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download