72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483

Analysis

max time kernel
188s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe
Size

1.3MB
MD5

805e9abef9307bd391dcd0e9a254fa22
SHA1

bd41410e6047de1c41eab786d8346dc8ede2137e
SHA256

72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483
SHA512

22e6a1cba09be59489ff62857eb309afa79dd0a4c2bee8f84a6eb1cfeb3a2671ec794d749b549c3372bd9115da81a70a2f866e48c99fd8c7f73841a30f8e8595
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakq:7rKo4ZwCOnYjVmJPah

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe

description	pid	process	target process
PID 3352 set thread context of 2136	3352	72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe	72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe

pid	process
2136	72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe
2136	72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe
2136	72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe
2136	72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe
2136	72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe

description	pid	process	target process
PID 3352 wrote to memory of 2136	3352	72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe	72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe
PID 3352 wrote to memory of 2136	3352	72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe	72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe
PID 3352 wrote to memory of 2136	3352	72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe	72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe
PID 3352 wrote to memory of 2136	3352	72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe	72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe
PID 3352 wrote to memory of 2136	3352	72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe	72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe
PID 3352 wrote to memory of 2136	3352	72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe	72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe
PID 3352 wrote to memory of 2136	3352	72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe	72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe
PID 3352 wrote to memory of 2136	3352	72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe	72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe
PID 3352 wrote to memory of 2136	3352	72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe	72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe
PID 3352 wrote to memory of 2136	3352	72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe	72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe

C:\Users\Admin\AppData\Local\Temp\72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe
"C:\Users\Admin\AppData\Local\Temp\72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3352

C:\Users\Admin\AppData\Local\Temp\72d4a37e88a7d558b78e120db2e0dbe13327c9eb1ffe16e4ef11c546c28cf483.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:2136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2136-132-0x0000000000000000-mapping.dmp

Download
memory/2136-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2136-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2136-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2136-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2136-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2136-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download