5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15

Analysis

max time kernel
169s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe
Size

1.3MB
MD5

b02578af75311cd703563ab4a9da574d
SHA1

6ea565efb347fbd3a1e39650f5c82e6690b134a8
SHA256

5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15
SHA512

ff92464711bd69e8ad1b03a4ad4196cf5561949f449451d1689f22593bb3dc16cefa1c91daf6a9fb1a521e3cc9bdceec94a332d5e31c0e27288679fa7d1bebd5
SSDEEP

24576:HOiZzDXGLFP53UG7bL1HohIE6BvRx0GOb/4+a0q3bhAqtxe9/9:ui1DWLFP53UGe76x0ZUphdtq9

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe

description	pid	process	target process
PID 536 set thread context of 2776	536	5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe	5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe

pid	process
2776	5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe
2776	5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe
2776	5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe
2776	5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe
2776	5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe

description	pid	process	target process
PID 536 wrote to memory of 2776	536	5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe	5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe
PID 536 wrote to memory of 2776	536	5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe	5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe
PID 536 wrote to memory of 2776	536	5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe	5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe
PID 536 wrote to memory of 2776	536	5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe	5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe
PID 536 wrote to memory of 2776	536	5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe	5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe
PID 536 wrote to memory of 2776	536	5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe	5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe
PID 536 wrote to memory of 2776	536	5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe	5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe
PID 536 wrote to memory of 2776	536	5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe	5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe
PID 536 wrote to memory of 2776	536	5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe	5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe
PID 536 wrote to memory of 2776	536	5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe	5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe

C:\Users\Admin\AppData\Local\Temp\5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe
"C:\Users\Admin\AppData\Local\Temp\5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:536

C:\Users\Admin\AppData\Local\Temp\5ae69f028689280f730593fd12437bee11c5d35d4a595b8c918802d5d1c54e15.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:2776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2776-132-0x0000000000000000-mapping.dmp

Download
memory/2776-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2776-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2776-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2776-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2776-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2776-138-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download