4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b

Analysis

max time kernel
183s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe
Size

1.3MB
MD5

fe9c2d25df62e4c44e59fcd76a6b15a2
SHA1

47d3dea5e2cb90ddc69513bacdf5ea1f09c34451
SHA256

4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b
SHA512

0b7996acfbd58fa33da62ce497f7dcff3a2c346cff1e3e52f9fd1a7b855d7bf878a5871057cc80caf7b68545d2a1b5bb544f6391a771f4c84cbfc7d0f331f808
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakm:TrKo4ZwCOnYjVmJPa5

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe

description	pid	process	target process
PID 1668 set thread context of 2640	1668	4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe	4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe

pid	process
2640	4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe
2640	4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe
2640	4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe
2640	4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe
2640	4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe

description	pid	process	target process
PID 1668 wrote to memory of 2640	1668	4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe	4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe
PID 1668 wrote to memory of 2640	1668	4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe	4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe
PID 1668 wrote to memory of 2640	1668	4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe	4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe
PID 1668 wrote to memory of 2640	1668	4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe	4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe
PID 1668 wrote to memory of 2640	1668	4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe	4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe
PID 1668 wrote to memory of 2640	1668	4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe	4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe
PID 1668 wrote to memory of 2640	1668	4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe	4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe
PID 1668 wrote to memory of 2640	1668	4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe	4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe
PID 1668 wrote to memory of 2640	1668	4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe	4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe
PID 1668 wrote to memory of 2640	1668	4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe	4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe

C:\Users\Admin\AppData\Local\Temp\4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe
"C:\Users\Admin\AppData\Local\Temp\4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Users\Admin\AppData\Local\Temp\4ae476370263a44758636914dc2a5216d6d4eb21149d48afe14345e120e6d07b.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2640-132-0x0000000000000000-mapping.dmp

Download
memory/2640-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2640-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2640-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2640-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2640-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download