75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626

Analysis

max time kernel
189s
max time network
225s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe
Size

1.3MB
MD5

3c0d47ea4f1d44a3a544549462db3db9
SHA1

bae4c290e480f66b7b64de7bd108a71293828153
SHA256

75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626
SHA512

4fb297f45b5d31d3b9e08d699cdf0f24321215b2f914c2772042c7dfc8038f65f26fa5bac47f9015ac0c2195c3239974fd57a867184af7fd43128df6f9bffcde
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak:TrKo4ZwCOnYjVmJPa

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe

description	pid	process	target process
PID 2912 set thread context of 1524	2912	75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe	75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe

pid	process
1524	75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe
1524	75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe
1524	75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe
1524	75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe
1524	75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe

description	pid	process	target process
PID 2912 wrote to memory of 1524	2912	75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe	75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe
PID 2912 wrote to memory of 1524	2912	75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe	75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe
PID 2912 wrote to memory of 1524	2912	75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe	75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe
PID 2912 wrote to memory of 1524	2912	75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe	75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe
PID 2912 wrote to memory of 1524	2912	75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe	75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe
PID 2912 wrote to memory of 1524	2912	75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe	75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe
PID 2912 wrote to memory of 1524	2912	75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe	75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe
PID 2912 wrote to memory of 1524	2912	75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe	75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe
PID 2912 wrote to memory of 1524	2912	75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe	75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe
PID 2912 wrote to memory of 1524	2912	75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe	75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe

C:\Users\Admin\AppData\Local\Temp\75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe
"C:\Users\Admin\AppData\Local\Temp\75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2912

C:\Users\Admin\AppData\Local\Temp\75acbefb1dadc48b40368e06da99069d08e6b111a9144b4cd6a4c80a9c679626.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:1524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1524-132-0x0000000000000000-mapping.dmp

Download
memory/1524-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1524-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1524-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1524-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1524-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download