56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165

Analysis

max time kernel
339s
max time network
403s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe
Size

1.6MB
MD5

124d5edb3d08cda62ff7eb12e9a569b8
SHA1

8812e69267ea46ab17485f3d61df79a9ec9df129
SHA256

56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165
SHA512

83140d126a166659130cc2cbb94bb11e86715557dca9d6446d52aadcf0ae898555cde90bab4a0267a35194569c1048358a28db6bb6b5d5c1a7ab8bfb5ae26a0b
SSDEEP

24576:9zD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUYo:X6/ye0PIphrp9Zuvjqa0Uidv

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe

description	pid	process	target process
PID 3756 set thread context of 2320	3756	56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe	56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe

pid	process
2320	56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe
2320	56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe
2320	56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe
2320	56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe
2320	56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe

description	pid	process	target process
PID 3756 wrote to memory of 2320	3756	56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe	56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe
PID 3756 wrote to memory of 2320	3756	56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe	56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe
PID 3756 wrote to memory of 2320	3756	56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe	56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe
PID 3756 wrote to memory of 2320	3756	56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe	56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe
PID 3756 wrote to memory of 2320	3756	56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe	56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe
PID 3756 wrote to memory of 2320	3756	56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe	56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe
PID 3756 wrote to memory of 2320	3756	56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe	56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe
PID 3756 wrote to memory of 2320	3756	56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe	56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe
PID 3756 wrote to memory of 2320	3756	56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe	56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe
PID 3756 wrote to memory of 2320	3756	56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe	56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe

C:\Users\Admin\AppData\Local\Temp\56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe
"C:\Users\Admin\AppData\Local\Temp\56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3756

C:\Users\Admin\AppData\Local\Temp\56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe
"C:\Users\Admin\AppData\Local\Temp\56fbdad544da8ff1cf67b8af2921c0d6157016176908210abef8ecdd4b7fa165.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:2320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2320-132-0x0000000000000000-mapping.dmp

Download
memory/2320-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2320-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2320-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2320-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2320-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download