5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c

Analysis

max time kernel
60s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe
Size

1.6MB
MD5

51b65b75ce9e53b778014c5af7632159
SHA1

3903100804168c9a6159b5446ef862c7dc03beb6
SHA256

5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c
SHA512

1eaa13fa7db9a2e0d33082ecbb820a3b60647d6b0d0cb0c5b1b2d73c0fb461fe607d0386eb82269c3da6cf96b8d0b4cb9e0d30f0080315030498ef06a86ab90c
SSDEEP

24576:9zD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUYO:X6/ye0PIphrp9Zuvjqa0UidJ

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe

description	pid	process	target process
PID 4396 set thread context of 1584	4396	5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe	5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe

pid	process
1584	5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe
1584	5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe
1584	5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe
1584	5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe
1584	5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe

description	pid	process	target process
PID 4396 wrote to memory of 1584	4396	5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe	5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe
PID 4396 wrote to memory of 1584	4396	5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe	5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe
PID 4396 wrote to memory of 1584	4396	5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe	5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe
PID 4396 wrote to memory of 1584	4396	5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe	5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe
PID 4396 wrote to memory of 1584	4396	5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe	5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe
PID 4396 wrote to memory of 1584	4396	5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe	5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe
PID 4396 wrote to memory of 1584	4396	5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe	5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe
PID 4396 wrote to memory of 1584	4396	5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe	5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe
PID 4396 wrote to memory of 1584	4396	5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe	5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe
PID 4396 wrote to memory of 1584	4396	5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe	5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe

C:\Users\Admin\AppData\Local\Temp\5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe
"C:\Users\Admin\AppData\Local\Temp\5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4396

C:\Users\Admin\AppData\Local\Temp\5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe
"C:\Users\Admin\AppData\Local\Temp\5d0779ecc3897a11768ce37868ecb77770c918e17c72712ef757495f8e72ae6c.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1584-132-0x0000000000000000-mapping.dmp

Download
memory/1584-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1584-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1584-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1584-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1584-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download