58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe
Size

1.3MB
MD5

78388625a0a8a6449b997b2019639734
SHA1

69308d2448942b604c85438322ebc0603ceb9919
SHA256

58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859
SHA512

5b45b54f9aafff988a8b5859f6b077e0c956f196bcbfd4e65b7fe389ecd36a86dda79353b2f5e612e501444ba2d4f9c519c24459bd4e35388ec345fd12279ca0
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakK:TrKo4ZwCOnYjVmJPax

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe

description	pid	process	target process
PID 808 set thread context of 2944	808	58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe	58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe

pid	process
2944	58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe
2944	58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe
2944	58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe
2944	58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe
2944	58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe

description	pid	process	target process
PID 808 wrote to memory of 2944	808	58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe	58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe
PID 808 wrote to memory of 2944	808	58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe	58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe
PID 808 wrote to memory of 2944	808	58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe	58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe
PID 808 wrote to memory of 2944	808	58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe	58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe
PID 808 wrote to memory of 2944	808	58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe	58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe
PID 808 wrote to memory of 2944	808	58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe	58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe
PID 808 wrote to memory of 2944	808	58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe	58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe
PID 808 wrote to memory of 2944	808	58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe	58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe
PID 808 wrote to memory of 2944	808	58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe	58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe
PID 808 wrote to memory of 2944	808	58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe	58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe

C:\Users\Admin\AppData\Local\Temp\58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe
"C:\Users\Admin\AppData\Local\Temp\58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:808

C:\Users\Admin\AppData\Local\Temp\58f2713bc11cac7a1884620c240837aed6ee3b7f5376fa4117fc88ae61af5859.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:2944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2944-132-0x0000000000000000-mapping.dmp

Download
memory/2944-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2944-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2944-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2944-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2944-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download