47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe
Size

1.3MB
MD5

db32ce5d80db4e8cfbaee6a83cbc78af
SHA1

5a931b18ba49930642b4bb319cff63cd2a15f00b
SHA256

47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13
SHA512

1a7c0683421000627c286fc8030e771675317d76e49b870f78a627253209f0c7b8afc31b8ce3ebf660ea2d6d66d950a63a1923a349e0c3794b587844328908be
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPako:zrKo4ZwCOnYjVmJPaX

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe

description	pid	process	target process
PID 800 set thread context of 444	800	47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe	47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe

pid	process
444	47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe
444	47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe
444	47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe
444	47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe
444	47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe

description	pid	process	target process
PID 800 wrote to memory of 444	800	47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe	47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe
PID 800 wrote to memory of 444	800	47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe	47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe
PID 800 wrote to memory of 444	800	47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe	47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe
PID 800 wrote to memory of 444	800	47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe	47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe
PID 800 wrote to memory of 444	800	47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe	47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe
PID 800 wrote to memory of 444	800	47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe	47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe
PID 800 wrote to memory of 444	800	47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe	47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe
PID 800 wrote to memory of 444	800	47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe	47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe
PID 800 wrote to memory of 444	800	47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe	47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe
PID 800 wrote to memory of 444	800	47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe	47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe

C:\Users\Admin\AppData\Local\Temp\47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe
"C:\Users\Admin\AppData\Local\Temp\47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:800

C:\Users\Admin\AppData\Local\Temp\47354f23c3011b4b86fc59783be77232753d3f891defa276a97c55d04194be13.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/444-132-0x0000000000000000-mapping.dmp

Download
memory/444-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/444-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/444-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/444-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/444-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/444-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download