4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe
Size

1.6MB
MD5

2cb54daaeab71f3c5923b167e826240b
SHA1

0a8fd9e126121836a274dcf7a42bc94edc4e34fc
SHA256

4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089
SHA512

518f463a00c3effc73153c2fecf8db20695911ce058139221036a0b3032d14784b2d29473125eaebefe15f3f1248859b3959742aff79d47383303ec28f132aeb
SSDEEP

24576:tzD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUYz:H6/ye0PIphrp9Zuvjqa0Uidw

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe

description	pid	process	target process
PID 916 set thread context of 2136	916	4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe	4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe

pid	process
2136	4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe
2136	4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe
2136	4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe
2136	4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe
2136	4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe

description	pid	process	target process
PID 916 wrote to memory of 2136	916	4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe	4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe
PID 916 wrote to memory of 2136	916	4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe	4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe
PID 916 wrote to memory of 2136	916	4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe	4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe
PID 916 wrote to memory of 2136	916	4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe	4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe
PID 916 wrote to memory of 2136	916	4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe	4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe
PID 916 wrote to memory of 2136	916	4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe	4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe
PID 916 wrote to memory of 2136	916	4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe	4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe
PID 916 wrote to memory of 2136	916	4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe	4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe
PID 916 wrote to memory of 2136	916	4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe	4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe
PID 916 wrote to memory of 2136	916	4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe	4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe

C:\Users\Admin\AppData\Local\Temp\4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe
"C:\Users\Admin\AppData\Local\Temp\4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:916
- C:\Users\Admin\AppData\Local\Temp\4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe
  "C:\Users\Admin\AppData\Local\Temp\4d1ab66725f4026390d1707f92f462fa32f94f93fd8915eb7bbd0913ca239089.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2136-132-0x0000000000000000-mapping.dmp

Download
memory/2136-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2136-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2136-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2136-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2136-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download