353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c

Analysis

max time kernel
187s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
Size

1.3MB
MD5

921ddaecbfe34d325da626b079b2625a
SHA1

ff88da32565d58fbf0497077a0baf62677c21834
SHA256

353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c
SHA512

5a6662661a14669296cbacac95fe7db328d73de7b7db39526ff74a091886f2722db89cfb690ebdf5cb1bff73c91cbb13f895b3e8443f3362ae1057a2da7a8234
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakt:zrKo4ZwCOnYjVmJPaS

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe

description	pid	process	target process
PID 2076 set thread context of 1552	2076	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe

pid	process
1552	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
1552	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
1552	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
1552	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
1552	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe

description	pid	process	target process
PID 2076 wrote to memory of 1552	2076	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
PID 2076 wrote to memory of 1552	2076	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
PID 2076 wrote to memory of 1552	2076	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
PID 2076 wrote to memory of 1552	2076	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
PID 2076 wrote to memory of 1552	2076	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
PID 2076 wrote to memory of 1552	2076	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
PID 2076 wrote to memory of 1552	2076	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
PID 2076 wrote to memory of 1552	2076	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
PID 2076 wrote to memory of 1552	2076	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
PID 2076 wrote to memory of 1552	2076	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe

C:\Users\Admin\AppData\Local\Temp\353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
"C:\Users\Admin\AppData\Local\Temp\353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Users\Admin\AppData\Local\Temp\353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1552-132-0x0000000000000000-mapping.dmp

Download
memory/1552-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1552-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1552-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1552-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1552-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download