835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22

Analysis

max time kernel
152s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe
Size

1.3MB
MD5

30a51a38748746115cf97067b606bab2
SHA1

60be56b6b59260aaeb1cb2f0c10cfa5b2c060fe1
SHA256

835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22
SHA512

a2741ae0865a71394eb3e0002718bb0ede11056218ec782398c09687ebd9ad918d40a766ed936b4ac61f6af7dad09c2b1a6fb0963451fb82f8ac39e975690fa2
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakl:TrKo4ZwCOnYjVmJPae

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe

description	pid	process	target process
PID 1336 set thread context of 2548	1336	835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe	835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe

pid	process
2548	835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe
2548	835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe
2548	835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe
2548	835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe
2548	835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe

description	pid	process	target process
PID 1336 wrote to memory of 2548	1336	835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe	835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe
PID 1336 wrote to memory of 2548	1336	835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe	835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe
PID 1336 wrote to memory of 2548	1336	835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe	835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe
PID 1336 wrote to memory of 2548	1336	835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe	835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe
PID 1336 wrote to memory of 2548	1336	835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe	835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe
PID 1336 wrote to memory of 2548	1336	835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe	835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe
PID 1336 wrote to memory of 2548	1336	835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe	835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe
PID 1336 wrote to memory of 2548	1336	835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe	835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe
PID 1336 wrote to memory of 2548	1336	835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe	835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe
PID 1336 wrote to memory of 2548	1336	835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe	835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe

C:\Users\Admin\AppData\Local\Temp\835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe
"C:\Users\Admin\AppData\Local\Temp\835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1336

C:\Users\Admin\AppData\Local\Temp\835ceae9e9669be86d2751e9574877fcc45a916fe28abd361b7b8dccedd6cf22.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:2548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2548-132-0x0000000000000000-mapping.dmp

Download
memory/2548-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2548-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2548-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2548-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2548-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download