70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe
Size

1.3MB
MD5

bf7d822d4a1f820eba5b6402e0436f8d
SHA1

738d5258fd897d3a15a3f5f10f6fb1bb8f75d553
SHA256

70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e
SHA512

5448ca7afe158f4267ef7ab5a9de54a9687b83e59aed43e896719f8fa18f8ce344d4811cdd6dae1f0980379ecdaf6a9bb73d552f781042391b43bdfa94d93578
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak/:zrKo4ZwCOnYjVmJPaw

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe

description	pid	process	target process
PID 4776 set thread context of 4972	4776	70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe	70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe

pid	process
4972	70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe
4972	70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe
4972	70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe
4972	70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe
4972	70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe

description	pid	process	target process
PID 4776 wrote to memory of 4972	4776	70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe	70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe
PID 4776 wrote to memory of 4972	4776	70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe	70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe
PID 4776 wrote to memory of 4972	4776	70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe	70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe
PID 4776 wrote to memory of 4972	4776	70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe	70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe
PID 4776 wrote to memory of 4972	4776	70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe	70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe
PID 4776 wrote to memory of 4972	4776	70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe	70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe
PID 4776 wrote to memory of 4972	4776	70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe	70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe
PID 4776 wrote to memory of 4972	4776	70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe	70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe
PID 4776 wrote to memory of 4972	4776	70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe	70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe
PID 4776 wrote to memory of 4972	4776	70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe	70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe

C:\Users\Admin\AppData\Local\Temp\70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe
"C:\Users\Admin\AppData\Local\Temp\70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4776

C:\Users\Admin\AppData\Local\Temp\70b2c5d2521fc8d5a83a0b6dc3036ae2b01dde3135e3b413c388e69e30c8389e.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4972-132-0x0000000000000000-mapping.dmp

Download
memory/4972-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4972-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4972-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4972-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4972-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download