727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95

Analysis

max time kernel
125s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe
Size

1.3MB
MD5

772e165f1bb81decc6db941a89317764
SHA1

4a53b9861fcba0347b339746ca07898f1b60cbdc
SHA256

727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95
SHA512

89c9fe6c3850e00a478d677a647ee2d3034a6983b88f7718557293260b363732b4364c9e68a63d3be6a78855ee57c23f2b2767cb78bcd6d07b8b30d79a3cfc2e
SSDEEP

24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakg:jrKo4ZwCOnYjVmJPa7

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe

description	pid	process	target process
PID 3008 set thread context of 1836	3008	727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe	727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe

pid	process
1836	727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe
1836	727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe
1836	727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe
1836	727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe
1836	727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe

description	pid	process	target process
PID 3008 wrote to memory of 1836	3008	727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe	727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe
PID 3008 wrote to memory of 1836	3008	727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe	727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe
PID 3008 wrote to memory of 1836	3008	727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe	727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe
PID 3008 wrote to memory of 1836	3008	727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe	727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe
PID 3008 wrote to memory of 1836	3008	727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe	727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe
PID 3008 wrote to memory of 1836	3008	727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe	727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe
PID 3008 wrote to memory of 1836	3008	727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe	727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe
PID 3008 wrote to memory of 1836	3008	727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe	727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe
PID 3008 wrote to memory of 1836	3008	727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe	727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe
PID 3008 wrote to memory of 1836	3008	727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe	727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe

C:\Users\Admin\AppData\Local\Temp\727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe
"C:\Users\Admin\AppData\Local\Temp\727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3008

C:\Users\Admin\AppData\Local\Temp\727790d4d6afb0ae978a646feb3b79843dc58f6b78b259f42467b49ac5d1bd95.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:1836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1836-132-0x0000000000000000-mapping.dmp

Download
memory/1836-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1836-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1836-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1836-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1836-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download