486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183

Analysis

max time kernel
87s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe
Size

1.3MB
MD5

e4a65e294147b68e61f5777d214dfbc0
SHA1

2120eb183925e70928a22cb87a70315be91e1fff
SHA256

486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183
SHA512

2361d18fb662da9ba5b9f359040ca74e187d53062e830786d7cd22d0f2cb5a6d96530d9ca3c6dd2cd8063ba35e6b78d3821f734bfc0f7fe47a149c35300f10e6
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakw:zrKo4ZwCOnYjVmJPa7

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe

description	pid	process	target process
PID 2760 set thread context of 2032	2760	486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe	486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe

pid	process
2032	486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe
2032	486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe
2032	486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe
2032	486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe
2032	486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe

description	pid	process	target process
PID 2760 wrote to memory of 2032	2760	486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe	486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe
PID 2760 wrote to memory of 2032	2760	486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe	486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe
PID 2760 wrote to memory of 2032	2760	486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe	486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe
PID 2760 wrote to memory of 2032	2760	486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe	486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe
PID 2760 wrote to memory of 2032	2760	486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe	486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe
PID 2760 wrote to memory of 2032	2760	486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe	486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe
PID 2760 wrote to memory of 2032	2760	486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe	486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe
PID 2760 wrote to memory of 2032	2760	486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe	486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe
PID 2760 wrote to memory of 2032	2760	486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe	486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe
PID 2760 wrote to memory of 2032	2760	486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe	486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe

C:\Users\Admin\AppData\Local\Temp\486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe
"C:\Users\Admin\AppData\Local\Temp\486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2760

C:\Users\Admin\AppData\Local\Temp\486781caddd05fa36f0f0880e73eb9da3f256d7a52745a2c7b7cf752155ee183.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:2032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2032-132-0x0000000000000000-mapping.dmp

Download
memory/2032-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2032-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2032-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2032-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2032-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2032-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download