5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79

Analysis

max time kernel
137s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe
Size

1.3MB
MD5

8f71a01b7bb7fd5a3fab69ae035d0579
SHA1

5b036ffd8cbbef4f09e282ee42d44f853d0d2835
SHA256

5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79
SHA512

1fd51583ba1e016ec409421dc62dec282433b14b451b59afde63bdf249021a0e0681867e2e98c9cdde1d0e9ac3f319ed3e01027b75019d9846e719ff9e8148db
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakQ:TrKo4ZwCOnYjVmJPaj

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe

description	pid	process	target process
PID 1224 set thread context of 3884	1224	5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe	5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe

pid	process
3884	5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe
3884	5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe
3884	5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe
3884	5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe
3884	5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe

description	pid	process	target process
PID 1224 wrote to memory of 3884	1224	5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe	5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe
PID 1224 wrote to memory of 3884	1224	5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe	5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe
PID 1224 wrote to memory of 3884	1224	5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe	5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe
PID 1224 wrote to memory of 3884	1224	5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe	5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe
PID 1224 wrote to memory of 3884	1224	5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe	5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe
PID 1224 wrote to memory of 3884	1224	5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe	5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe
PID 1224 wrote to memory of 3884	1224	5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe	5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe
PID 1224 wrote to memory of 3884	1224	5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe	5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe
PID 1224 wrote to memory of 3884	1224	5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe	5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe
PID 1224 wrote to memory of 3884	1224	5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe	5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe

C:\Users\Admin\AppData\Local\Temp\5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe
"C:\Users\Admin\AppData\Local\Temp\5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1224

C:\Users\Admin\AppData\Local\Temp\5911cabadb3ba596ea3c6d142d065fcd641b399099e30913b5cfe0e857360c79.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:3884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3884-132-0x0000000000000000-mapping.dmp

Download
memory/3884-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3884-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3884-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3884-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3884-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3884-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download