438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37

Analysis

max time kernel
114s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe
Size

1.3MB
MD5

100ff69b371e5b8656c5d71da7a2f44a
SHA1

2fc9c3ace5afbde5e79e38fd0060fe26003715d9
SHA256

438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37
SHA512

d85d4c0e1cfb4bf107f388e3641ad3220ab53e851a5af30efee22007c3dfaa1557d361dd82c55e8ff1005204e0ef34f9b7777d0f4b00cd3b1fd59c1d5b226912
SSDEEP

24576:DrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakn:DrKo4ZwCOnYjVmJPaw

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe

description	pid	process	target process
PID 2992 set thread context of 3976	2992	438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe	438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe

pid	process
3976	438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe
3976	438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe
3976	438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe
3976	438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe
3976	438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe

description	pid	process	target process
PID 2992 wrote to memory of 3976	2992	438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe	438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe
PID 2992 wrote to memory of 3976	2992	438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe	438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe
PID 2992 wrote to memory of 3976	2992	438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe	438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe
PID 2992 wrote to memory of 3976	2992	438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe	438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe
PID 2992 wrote to memory of 3976	2992	438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe	438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe
PID 2992 wrote to memory of 3976	2992	438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe	438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe
PID 2992 wrote to memory of 3976	2992	438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe	438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe
PID 2992 wrote to memory of 3976	2992	438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe	438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe
PID 2992 wrote to memory of 3976	2992	438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe	438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe
PID 2992 wrote to memory of 3976	2992	438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe	438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe

C:\Users\Admin\AppData\Local\Temp\438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe
"C:\Users\Admin\AppData\Local\Temp\438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2992

C:\Users\Admin\AppData\Local\Temp\438dffcf4fc5410a9ed1d062ef3ff42e7c26f514df85d2a5117de351fae74f37.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:3976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3976-132-0x0000000000000000-mapping.dmp

Download
memory/3976-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3976-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3976-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3976-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3976-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3976-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download