Analysis
-
max time kernel
120s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 12:58
Static task
static1
Behavioral task
behavioral1
Sample
d944265f328e5132d337f892c93c2fd57177d63df4a94b673a34b9d31f54d829.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d944265f328e5132d337f892c93c2fd57177d63df4a94b673a34b9d31f54d829.exe
Resource
win10v2004-20220812-en
General
-
Target
d944265f328e5132d337f892c93c2fd57177d63df4a94b673a34b9d31f54d829.exe
-
Size
214KB
-
MD5
8a0b9249013f4ff754c97183e783f1aa
-
SHA1
015196e65a510351e5fe97fcb0f5263136b83a3f
-
SHA256
d944265f328e5132d337f892c93c2fd57177d63df4a94b673a34b9d31f54d829
-
SHA512
a0203ad197c233c6d108b62a5b9a1c5dfe30bf1f662649350eb6f9238f39092b6bc86a7959599f5c74eed57974f97298e69344cfe0d57eb90024dcb3a9402cde
-
SSDEEP
3072:4XEBR/+MRbTIW5knAYdOyCTkx3gKVYMe7jCf0KmSV0HAWrtkPqC3Lk:4X8/+MRb8EknAIOR322jCfb2HEb3g
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
d944265f328e5132d337f892c93c2fd57177d63df4a94b673a34b9d31f54d829.exedescription pid process target process PID 4940 set thread context of 5044 4940 d944265f328e5132d337f892c93c2fd57177d63df4a94b673a34b9d31f54d829.exe d944265f328e5132d337f892c93c2fd57177d63df4a94b673a34b9d31f54d829.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
d944265f328e5132d337f892c93c2fd57177d63df4a94b673a34b9d31f54d829.exedescription pid process target process PID 4940 wrote to memory of 5044 4940 d944265f328e5132d337f892c93c2fd57177d63df4a94b673a34b9d31f54d829.exe d944265f328e5132d337f892c93c2fd57177d63df4a94b673a34b9d31f54d829.exe PID 4940 wrote to memory of 5044 4940 d944265f328e5132d337f892c93c2fd57177d63df4a94b673a34b9d31f54d829.exe d944265f328e5132d337f892c93c2fd57177d63df4a94b673a34b9d31f54d829.exe PID 4940 wrote to memory of 5044 4940 d944265f328e5132d337f892c93c2fd57177d63df4a94b673a34b9d31f54d829.exe d944265f328e5132d337f892c93c2fd57177d63df4a94b673a34b9d31f54d829.exe PID 4940 wrote to memory of 5044 4940 d944265f328e5132d337f892c93c2fd57177d63df4a94b673a34b9d31f54d829.exe d944265f328e5132d337f892c93c2fd57177d63df4a94b673a34b9d31f54d829.exe PID 4940 wrote to memory of 5044 4940 d944265f328e5132d337f892c93c2fd57177d63df4a94b673a34b9d31f54d829.exe d944265f328e5132d337f892c93c2fd57177d63df4a94b673a34b9d31f54d829.exe PID 4940 wrote to memory of 5044 4940 d944265f328e5132d337f892c93c2fd57177d63df4a94b673a34b9d31f54d829.exe d944265f328e5132d337f892c93c2fd57177d63df4a94b673a34b9d31f54d829.exe PID 4940 wrote to memory of 5044 4940 d944265f328e5132d337f892c93c2fd57177d63df4a94b673a34b9d31f54d829.exe d944265f328e5132d337f892c93c2fd57177d63df4a94b673a34b9d31f54d829.exe PID 4940 wrote to memory of 5044 4940 d944265f328e5132d337f892c93c2fd57177d63df4a94b673a34b9d31f54d829.exe d944265f328e5132d337f892c93c2fd57177d63df4a94b673a34b9d31f54d829.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d944265f328e5132d337f892c93c2fd57177d63df4a94b673a34b9d31f54d829.exe"C:\Users\Admin\AppData\Local\Temp\d944265f328e5132d337f892c93c2fd57177d63df4a94b673a34b9d31f54d829.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d944265f328e5132d337f892c93c2fd57177d63df4a94b673a34b9d31f54d829.exeC:\Users\Admin\AppData\Local\Temp\d944265f328e5132d337f892c93c2fd57177d63df4a94b673a34b9d31f54d829.exe2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5044-132-0x0000000000000000-mapping.dmp
-
memory/5044-133-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/5044-135-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/5044-136-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB