596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79

Analysis

max time kernel
158s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe
Size

1.3MB
MD5

f810d0c723942b7f7f639feb8e107bd4
SHA1

90eb8e78dcd0a8176c14341f784b4915806c8f75
SHA256

596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79
SHA512

9a73fa919673545b6ecab7a7d714b517a01a69b573044be7cb205504e7852ce30462a532d9e5ef3487e160975831eda36d4ead472aed8c6cb39a4859d36c30a3
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak3:TrKo4ZwCOnYjVmJPaw

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe

description	pid	process	target process
PID 4460 set thread context of 712	4460	596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe	596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe

pid	process
712	596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe
712	596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe
712	596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe
712	596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe
712	596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe

description	pid	process	target process
PID 4460 wrote to memory of 712	4460	596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe	596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe
PID 4460 wrote to memory of 712	4460	596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe	596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe
PID 4460 wrote to memory of 712	4460	596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe	596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe
PID 4460 wrote to memory of 712	4460	596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe	596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe
PID 4460 wrote to memory of 712	4460	596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe	596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe
PID 4460 wrote to memory of 712	4460	596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe	596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe
PID 4460 wrote to memory of 712	4460	596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe	596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe
PID 4460 wrote to memory of 712	4460	596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe	596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe
PID 4460 wrote to memory of 712	4460	596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe	596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe
PID 4460 wrote to memory of 712	4460	596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe	596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe

C:\Users\Admin\AppData\Local\Temp\596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe
"C:\Users\Admin\AppData\Local\Temp\596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4460

C:\Users\Admin\AppData\Local\Temp\596f1d7dcd7ef5194c26e82331ee42952546fee0803337505326c012c9853c79.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/712-132-0x0000000000000000-mapping.dmp

Download
memory/712-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/712-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/712-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/712-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/712-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/712-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download