4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9

Analysis

max time kernel
158s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe
Size

1.6MB
MD5

5641f7f16e58a6a62ac6d29e3a6fb4db
SHA1

b743a93168fd121d1a7b8f9886df9e6e7b932cc7
SHA256

4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9
SHA512

8d620f13bd13fe5b3bcf8ac1357a7eb9490b2741ce9dc8a7b076e144e95e2a5ac56f11ee763f9f634ce6ad6f6030890fcfcb204e2450143cba48790ccbf8f268
SSDEEP

24576:RzD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUYS:j6/ye0PIphrp9Zuvjqa0Uid9

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe

description	pid	process	target process
PID 4392 set thread context of 1272	4392	4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe	4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe

pid	process
1272	4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe
1272	4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe
1272	4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe
1272	4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe
1272	4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe

description	pid	process	target process
PID 4392 wrote to memory of 1272	4392	4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe	4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe
PID 4392 wrote to memory of 1272	4392	4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe	4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe
PID 4392 wrote to memory of 1272	4392	4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe	4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe
PID 4392 wrote to memory of 1272	4392	4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe	4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe
PID 4392 wrote to memory of 1272	4392	4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe	4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe
PID 4392 wrote to memory of 1272	4392	4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe	4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe
PID 4392 wrote to memory of 1272	4392	4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe	4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe
PID 4392 wrote to memory of 1272	4392	4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe	4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe
PID 4392 wrote to memory of 1272	4392	4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe	4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe
PID 4392 wrote to memory of 1272	4392	4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe	4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe

C:\Users\Admin\AppData\Local\Temp\4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe
"C:\Users\Admin\AppData\Local\Temp\4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Users\Admin\AppData\Local\Temp\4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe
  "C:\Users\Admin\AppData\Local\Temp\4da0fd4451c59bba21e8ceb2f501c6e02938186d4f0c99be9c5f0471726ff1f9.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1272-132-0x0000000000000000-mapping.dmp

Download
memory/1272-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1272-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1272-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1272-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1272-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1272-138-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download