3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636

Analysis

max time kernel
155s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe
Size

1.3MB
MD5

aad8730ad1c60da300b23b13ca11a2e3
SHA1

0dffe8207538d92f099c22a5887dfc75d916750b
SHA256

3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636
SHA512

5f0a63251dddda1b559ff21a84b0983c6bcc53a53b196627a52107720d4e2dcdbef0da27f79b778fefe04a3d6cecfab5156e5eb77cca04ff7152d11bf4cfa69e
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak+:TrKo4ZwCOnYjVmJPaN

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe

description	pid	process	target process
PID 2784 set thread context of 4308	2784	3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe	3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe

pid	process
4308	3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe
4308	3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe
4308	3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe
4308	3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe
4308	3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe

description	pid	process	target process
PID 2784 wrote to memory of 4308	2784	3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe	3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe
PID 2784 wrote to memory of 4308	2784	3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe	3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe
PID 2784 wrote to memory of 4308	2784	3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe	3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe
PID 2784 wrote to memory of 4308	2784	3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe	3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe
PID 2784 wrote to memory of 4308	2784	3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe	3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe
PID 2784 wrote to memory of 4308	2784	3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe	3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe
PID 2784 wrote to memory of 4308	2784	3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe	3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe
PID 2784 wrote to memory of 4308	2784	3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe	3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe
PID 2784 wrote to memory of 4308	2784	3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe	3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe
PID 2784 wrote to memory of 4308	2784	3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe	3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe

C:\Users\Admin\AppData\Local\Temp\3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe
"C:\Users\Admin\AppData\Local\Temp\3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2784

C:\Users\Admin\AppData\Local\Temp\3af93a04756f9c9ff3cee61b2ea6d0641f690e6306c6e19efeae680a93d0b636.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4308-132-0x0000000000000000-mapping.dmp

Download
memory/4308-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4308-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4308-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4308-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4308-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4308-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download