538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4

Analysis

max time kernel
188s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe
Size

1.3MB
MD5

6f3d65075a9b27af2a31797527507717
SHA1

e673fbf3d68a8067f632d2e3e225b1157fa88209
SHA256

538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4
SHA512

4c9978de3802ae754b9d5448cf4f6dcd9eb473ebae301f0e9ac978f4e6be7e5b84a0a222cb49d2ad3580d2c774efeb694459243df591a339b9edc5f3eb9696bb
SSDEEP

24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakG:jrKo4ZwCOnYjVmJPah

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe

description	pid	process	target process
PID 3860 set thread context of 564	3860	538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe	538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe

pid	process
564	538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe
564	538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe
564	538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe
564	538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe
564	538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe

description	pid	process	target process
PID 3860 wrote to memory of 564	3860	538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe	538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe
PID 3860 wrote to memory of 564	3860	538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe	538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe
PID 3860 wrote to memory of 564	3860	538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe	538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe
PID 3860 wrote to memory of 564	3860	538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe	538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe
PID 3860 wrote to memory of 564	3860	538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe	538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe
PID 3860 wrote to memory of 564	3860	538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe	538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe
PID 3860 wrote to memory of 564	3860	538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe	538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe
PID 3860 wrote to memory of 564	3860	538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe	538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe
PID 3860 wrote to memory of 564	3860	538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe	538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe
PID 3860 wrote to memory of 564	3860	538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe	538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe

C:\Users\Admin\AppData\Local\Temp\538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe
"C:\Users\Admin\AppData\Local\Temp\538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3860

C:\Users\Admin\AppData\Local\Temp\538441707d3d1a90698e1f7550ba87cd5e2fe3de4bec4c8739639820109293f4.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/564-132-0x0000000000000000-mapping.dmp

Download
memory/564-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/564-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/564-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/564-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/564-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/564-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download