4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475

Analysis

max time kernel
165s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe
Size

1.3MB
MD5

24f3479cbb425e8ef335b09bb5219c06
SHA1

ab5947b10635aee3ac9d22fa1ba69c1f7a6f859d
SHA256

4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475
SHA512

f2c6c50d19a37dcbd74114848afe02cab905a72ac9c78b4bc3eeea4d24bbdd5a8b58f19709f1b4cca0defa34f82987f45a95ff4e21dba5f332dbea2feaf57b7d
SSDEEP

24576:rrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak:rrKo4ZwCOnYjVmJPa

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe

description	pid	process	target process
PID 1668 set thread context of 2596	1668	4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe	4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe

pid	process
2596	4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe
2596	4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe
2596	4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe
2596	4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe
2596	4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe

description	pid	process	target process
PID 1668 wrote to memory of 2596	1668	4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe	4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe
PID 1668 wrote to memory of 2596	1668	4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe	4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe
PID 1668 wrote to memory of 2596	1668	4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe	4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe
PID 1668 wrote to memory of 2596	1668	4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe	4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe
PID 1668 wrote to memory of 2596	1668	4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe	4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe
PID 1668 wrote to memory of 2596	1668	4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe	4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe
PID 1668 wrote to memory of 2596	1668	4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe	4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe
PID 1668 wrote to memory of 2596	1668	4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe	4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe
PID 1668 wrote to memory of 2596	1668	4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe	4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe
PID 1668 wrote to memory of 2596	1668	4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe	4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe

C:\Users\Admin\AppData\Local\Temp\4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe
"C:\Users\Admin\AppData\Local\Temp\4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1668

C:\Users\Admin\AppData\Local\Temp\4425ef496971ee94fc837081f28ed886236d889efd407dba9b3d345915f48475.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:2596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2596-132-0x0000000000000000-mapping.dmp

Download
memory/2596-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2596-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2596-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2596-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2596-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2596-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download