55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c

Analysis

max time kernel
172s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe
Size

1.3MB
MD5

b09ba6741f4432f9eba7fad8a99dc9d1
SHA1

ecb892312a87d28dbd38be411eee830cc95ddf76
SHA256

55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c
SHA512

2e5bdde72518bacf50ba4a76c8368c78c469c8f893302e362134f1d451ce153af4ad72c15d16d41b93976e19a3869c257167a0e610517f9ba761c2418fd28f27
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakS:zrKo4ZwCOnYjVmJPa5

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe

description	pid	process	target process
PID 364 set thread context of 1676	364	55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe	55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe

pid	process
1676	55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe
1676	55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe
1676	55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe
1676	55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe
1676	55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe

description	pid	process	target process
PID 364 wrote to memory of 1676	364	55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe	55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe
PID 364 wrote to memory of 1676	364	55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe	55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe
PID 364 wrote to memory of 1676	364	55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe	55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe
PID 364 wrote to memory of 1676	364	55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe	55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe
PID 364 wrote to memory of 1676	364	55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe	55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe
PID 364 wrote to memory of 1676	364	55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe	55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe
PID 364 wrote to memory of 1676	364	55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe	55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe
PID 364 wrote to memory of 1676	364	55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe	55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe
PID 364 wrote to memory of 1676	364	55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe	55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe
PID 364 wrote to memory of 1676	364	55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe	55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe

C:\Users\Admin\AppData\Local\Temp\55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe
"C:\Users\Admin\AppData\Local\Temp\55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:364

C:\Users\Admin\AppData\Local\Temp\55b126736f092f7f53c2977302bba2b696fcd80971ed106997397aea0d6fa51c.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:1676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1676-132-0x0000000000000000-mapping.dmp

Download
memory/1676-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1676-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1676-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1676-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1676-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1676-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download