53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a

Analysis

max time kernel
199s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe
Size

1.2MB
MD5

04fa12d2710f01f207f863968ff202bc
SHA1

4a31898c9fd5276040c1eb8df39db7e3ce6e7ebd
SHA256

53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a
SHA512

c33a7a8b86ec48cffbcf614b5fca67f758b0a3cc2d4f1a03e26afefdf3b527fd07720330b9156d076c6fe3c34fafe1f7567367b7d29e883e5362782d1f1a85ab
SSDEEP

12288:tSGxzDKw6w2qa3LgMc8SLFDY/8LeS2899E7D3AYNACMzb7noKcxl4B6obXWRAfbn:sxw8wFDY3wE3wY6cxI6gWUbIwMLHf/K

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe

description	pid	process	target process
PID 2064 set thread context of 932	2064	53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe	53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe

pid	process
932	53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe
932	53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe
932	53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe
932	53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe
932	53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe

description	pid	process	target process
PID 2064 wrote to memory of 932	2064	53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe	53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe
PID 2064 wrote to memory of 932	2064	53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe	53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe
PID 2064 wrote to memory of 932	2064	53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe	53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe
PID 2064 wrote to memory of 932	2064	53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe	53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe
PID 2064 wrote to memory of 932	2064	53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe	53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe
PID 2064 wrote to memory of 932	2064	53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe	53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe
PID 2064 wrote to memory of 932	2064	53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe	53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe
PID 2064 wrote to memory of 932	2064	53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe	53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe
PID 2064 wrote to memory of 932	2064	53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe	53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe
PID 2064 wrote to memory of 932	2064	53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe	53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe

C:\Users\Admin\AppData\Local\Temp\53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe
"C:\Users\Admin\AppData\Local\Temp\53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2064

C:\Users\Admin\AppData\Local\Temp\53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe
"C:\Users\Admin\AppData\Local\Temp\53cb88713a4119ea0291f5b99ee463377744cba608f33acdb4146c34211b124a.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/932-132-0x0000000000000000-mapping.dmp

Download
memory/932-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/932-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/932-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/932-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/932-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/932-138-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download