696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd

Analysis

max time kernel
271s
max time network
347s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe
Size

1.6MB
MD5

4ac91f039de9123f1d6849f108041079
SHA1

7582224c9f22bec2469bf978c0702a6d38859e41
SHA256

696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd
SHA512

50b73e4dba43776de53368eefa7a39e23ef8b615aba2de646bd6aef7ba9b0dc0946ad3ebc7b40457a2f0a7dd3f52ddfc0105f4d42eb4f4441526b40e19f8cd09
SSDEEP

24576:xzD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUYl:D6/ye0PIphrp9Zuvjqa0UidK

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe

description	pid	process	target process
PID 4724 set thread context of 1628	4724	696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe	696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe

pid	process
1628	696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe
1628	696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe
1628	696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe
1628	696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe
1628	696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe

description	pid	process	target process
PID 4724 wrote to memory of 1628	4724	696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe	696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe
PID 4724 wrote to memory of 1628	4724	696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe	696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe
PID 4724 wrote to memory of 1628	4724	696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe	696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe
PID 4724 wrote to memory of 1628	4724	696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe	696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe
PID 4724 wrote to memory of 1628	4724	696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe	696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe
PID 4724 wrote to memory of 1628	4724	696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe	696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe
PID 4724 wrote to memory of 1628	4724	696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe	696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe
PID 4724 wrote to memory of 1628	4724	696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe	696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe
PID 4724 wrote to memory of 1628	4724	696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe	696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe
PID 4724 wrote to memory of 1628	4724	696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe	696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe

C:\Users\Admin\AppData\Local\Temp\696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe
"C:\Users\Admin\AppData\Local\Temp\696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Users\Admin\AppData\Local\Temp\696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe
  "C:\Users\Admin\AppData\Local\Temp\696c9af1240737be8ebf7c155e266fc41d04da47488d6baa2f99ba618018ffcd.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1628-132-0x0000000000000000-mapping.dmp

Download
memory/1628-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1628-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1628-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1628-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1628-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1628-138-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download