659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575

Analysis

max time kernel
139s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe
Size

1.3MB
MD5

a162ddf4404495b17b70c0dff91dcc8e
SHA1

fa5200acc8ba3fad14937a5687e978f351f94df7
SHA256

659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575
SHA512

e6eceb8fe58a438859e56cd8185d12973b0f84d1d22d6df6750ef3a458ef5e197c52ed998484fc867a348c32e0457228e73a5a2a6f1d45a0a7709c97f93f8c51
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakX:zrKo4ZwCOnYjVmJPaw

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe

description	pid	process	target process
PID 1484 set thread context of 1312	1484	659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe	659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe

pid	process
1312	659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe
1312	659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe
1312	659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe
1312	659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe
1312	659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe

description	pid	process	target process
PID 1484 wrote to memory of 1312	1484	659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe	659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe
PID 1484 wrote to memory of 1312	1484	659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe	659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe
PID 1484 wrote to memory of 1312	1484	659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe	659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe
PID 1484 wrote to memory of 1312	1484	659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe	659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe
PID 1484 wrote to memory of 1312	1484	659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe	659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe
PID 1484 wrote to memory of 1312	1484	659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe	659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe
PID 1484 wrote to memory of 1312	1484	659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe	659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe
PID 1484 wrote to memory of 1312	1484	659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe	659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe
PID 1484 wrote to memory of 1312	1484	659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe	659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe
PID 1484 wrote to memory of 1312	1484	659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe	659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe

C:\Users\Admin\AppData\Local\Temp\659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe
"C:\Users\Admin\AppData\Local\Temp\659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Users\Admin\AppData\Local\Temp\659a842a71346482fae1273b65417791b124f4ff74594f0564edb73aa94fc575.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1312-133-0x0000000000000000-mapping.dmp

Download
memory/1312-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1312-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1312-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1312-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1312-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download