81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b

Analysis

max time kernel
158s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe
Size

1.3MB
MD5

3b5542404ea0f7a15c66dabd4c5174d2
SHA1

2ca2b74e2fd446933ffd5fd15e66b29e1d3c1b9f
SHA256

81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b
SHA512

074e0dd7950cb9e3f0a41efc9986a4549f89b76d8d72994989b7b9d26bba40b22c00b0c169cddd19abd793e0fc145436aabb1236508accad291f948bbb462073
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakf:7rKo4ZwCOnYjVmJPao

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe

description	pid	process	target process
PID 4032 set thread context of 2640	4032	81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe	81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe

pid	process
2640	81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe
2640	81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe
2640	81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe
2640	81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe
2640	81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe

description	pid	process	target process
PID 4032 wrote to memory of 2640	4032	81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe	81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe
PID 4032 wrote to memory of 2640	4032	81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe	81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe
PID 4032 wrote to memory of 2640	4032	81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe	81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe
PID 4032 wrote to memory of 2640	4032	81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe	81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe
PID 4032 wrote to memory of 2640	4032	81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe	81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe
PID 4032 wrote to memory of 2640	4032	81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe	81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe
PID 4032 wrote to memory of 2640	4032	81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe	81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe
PID 4032 wrote to memory of 2640	4032	81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe	81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe
PID 4032 wrote to memory of 2640	4032	81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe	81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe
PID 4032 wrote to memory of 2640	4032	81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe	81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe

C:\Users\Admin\AppData\Local\Temp\81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe
"C:\Users\Admin\AppData\Local\Temp\81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4032

C:\Users\Admin\AppData\Local\Temp\81e8e7c36a3f285a3cd1988f3df0e189ab4ea62742ab6fb855e66bd2ec47802b.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:2640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2640-132-0x0000000000000000-mapping.dmp

Download
memory/2640-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2640-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2640-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2640-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2640-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download