3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac

Analysis

max time kernel
150s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe
Size

1.6MB
MD5

5927ffe1141b95e0db710e037d73c1c0
SHA1

9fe1a16880f6f4ddecb5146905f87364c3a98871
SHA256

3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac
SHA512

75049640b101308a1e7a6ffc3e1a2f987afc216f45494623ef2f1164c4c50b83bd59a5d0af52e5a51919c7af5622b5ce57ada4a6a1f34268026d4f3ae1f11fd4
SSDEEP

24576:BzD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUYo:T6/ye0PIphrp9Zuvjqa0UidL

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe

description	pid	process	target process
PID 3804 set thread context of 3644	3804	3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe	3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe

pid	process
3644	3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe
3644	3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe
3644	3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe
3644	3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe
3644	3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe

description	pid	process	target process
PID 3804 wrote to memory of 3644	3804	3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe	3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe
PID 3804 wrote to memory of 3644	3804	3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe	3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe
PID 3804 wrote to memory of 3644	3804	3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe	3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe
PID 3804 wrote to memory of 3644	3804	3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe	3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe
PID 3804 wrote to memory of 3644	3804	3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe	3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe
PID 3804 wrote to memory of 3644	3804	3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe	3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe
PID 3804 wrote to memory of 3644	3804	3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe	3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe
PID 3804 wrote to memory of 3644	3804	3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe	3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe
PID 3804 wrote to memory of 3644	3804	3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe	3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe
PID 3804 wrote to memory of 3644	3804	3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe	3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe

C:\Users\Admin\AppData\Local\Temp\3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe
"C:\Users\Admin\AppData\Local\Temp\3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3804

C:\Users\Admin\AppData\Local\Temp\3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe
"C:\Users\Admin\AppData\Local\Temp\3ae5922834e7c4b5f56d58629f59c860618cf145fbc346ebd47885d61ff18aac.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:3644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3644-132-0x0000000000000000-mapping.dmp

Download
memory/3644-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3644-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3644-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3644-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3644-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download