4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe
Size

1.3MB
MD5

6d556fc575d381fda4f50d49bcb57bee
SHA1

5ffc1fb61cd49088bc71548d9e3bf58d3a8843a4
SHA256

4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae
SHA512

2367130c1f9902001de68838539ca226e31c3137b1b85cc151cc3f88caa16db5e91e9a2eeca1fbf8c982e36f1908a6d18bcf431eed6752b5cee7ecb8b3fd0ecd
SSDEEP

24576:brKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak9:brKo4ZwCOnYjVmJPaW

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe

description	pid	process	target process
PID 4864 set thread context of 448	4864	4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe	4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe

pid	process
448	4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe
448	4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe
448	4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe
448	4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe
448	4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe

description	pid	process	target process
PID 4864 wrote to memory of 448	4864	4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe	4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe
PID 4864 wrote to memory of 448	4864	4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe	4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe
PID 4864 wrote to memory of 448	4864	4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe	4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe
PID 4864 wrote to memory of 448	4864	4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe	4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe
PID 4864 wrote to memory of 448	4864	4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe	4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe
PID 4864 wrote to memory of 448	4864	4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe	4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe
PID 4864 wrote to memory of 448	4864	4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe	4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe
PID 4864 wrote to memory of 448	4864	4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe	4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe
PID 4864 wrote to memory of 448	4864	4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe	4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe
PID 4864 wrote to memory of 448	4864	4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe	4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe

C:\Users\Admin\AppData\Local\Temp\4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe
"C:\Users\Admin\AppData\Local\Temp\4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Users\Admin\AppData\Local\Temp\4dd8ecf9a5555106682f81ba0034281c2961f83b09962e375cc4256ab3fa75ae.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/448-132-0x0000000000000000-mapping.dmp

Download
memory/448-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/448-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/448-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/448-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/448-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/448-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download