70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185

Analysis

max time kernel
158s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe
Size

1.1MB
MD5

1b86f15a35800272a7eefd74394eb546
SHA1

f8cbf093528320b6c36d0ed904e1d3c9397ddff9
SHA256

70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185
SHA512

1d929e3f154be70d551e22f70a9099871657f263ee66b223ddb711424f0d57a4353519c2a40ba3455abb820db9298b1d5775eb245a05e90bb1ac93dbe0ec5cc1
SSDEEP

24576:Y9jmOYKa/TY9ZPFXntEi+m/ZWOLB28TS3985qEeP02wJ:EqvkHZt7+mBWABf202S

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe

description	pid	process	target process
PID 2176 set thread context of 792	2176	70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe	70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe

pid	process
792	70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe
792	70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe
792	70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe
792	70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe
792	70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe

description	pid	process	target process
PID 2176 wrote to memory of 792	2176	70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe	70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe
PID 2176 wrote to memory of 792	2176	70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe	70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe
PID 2176 wrote to memory of 792	2176	70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe	70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe
PID 2176 wrote to memory of 792	2176	70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe	70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe
PID 2176 wrote to memory of 792	2176	70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe	70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe
PID 2176 wrote to memory of 792	2176	70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe	70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe
PID 2176 wrote to memory of 792	2176	70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe	70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe
PID 2176 wrote to memory of 792	2176	70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe	70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe
PID 2176 wrote to memory of 792	2176	70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe	70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe
PID 2176 wrote to memory of 792	2176	70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe	70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe

C:\Users\Admin\AppData\Local\Temp\70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe
"C:\Users\Admin\AppData\Local\Temp\70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2176

C:\Users\Admin\AppData\Local\Temp\70d9c28052616e32f5f8d867824d705fad66b8d548c9662383f976c02a531185.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/792-132-0x0000000000000000-mapping.dmp

Download
memory/792-133-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/792-134-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/792-135-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/792-136-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/792-137-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/792-138-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download