738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe
Size

1.3MB
MD5

d716caa8a9a6677dff83a04f9ef4bac9
SHA1

da0cd06bdb4465229320b4c3939998d1276e4ee8
SHA256

738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83
SHA512

fee3b462eb10caa3e38b8a306a64a6c6b96d513eabfe3a7b2f82c2b79df9098fd5f5035990c44ba9468e6a4a59f9edef81b2bb0252a057f62b00a706f7963849
SSDEEP

24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak1:jrKo4ZwCOnYjVmJPa6

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe

description	pid	process	target process
PID 2376 set thread context of 4380	2376	738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe	738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe

pid	process
4380	738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe
4380	738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe
4380	738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe
4380	738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe
4380	738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe

description	pid	process	target process
PID 2376 wrote to memory of 4380	2376	738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe	738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe
PID 2376 wrote to memory of 4380	2376	738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe	738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe
PID 2376 wrote to memory of 4380	2376	738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe	738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe
PID 2376 wrote to memory of 4380	2376	738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe	738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe
PID 2376 wrote to memory of 4380	2376	738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe	738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe
PID 2376 wrote to memory of 4380	2376	738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe	738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe
PID 2376 wrote to memory of 4380	2376	738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe	738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe
PID 2376 wrote to memory of 4380	2376	738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe	738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe
PID 2376 wrote to memory of 4380	2376	738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe	738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe
PID 2376 wrote to memory of 4380	2376	738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe	738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe

C:\Users\Admin\AppData\Local\Temp\738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe
"C:\Users\Admin\AppData\Local\Temp\738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2376

C:\Users\Admin\AppData\Local\Temp\738d76f4f7e98bfd03d9db1be7f07cd18ff517f4af21b8873a4d28fea62dfb83.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4380-132-0x0000000000000000-mapping.dmp

Download
memory/4380-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4380-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4380-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4380-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4380-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download