433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe
Size

1.6MB
MD5

c3e691b908992d8e22d2262512647eb5
SHA1

7972057345a5f642e4838fc051046284e3d4cae0
SHA256

433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1
SHA512

43f6142a54d828177f1ea7780897f805e727e639b3bb04d681ebdf2892650907260d7f5dfd662d5f88cd341373a7b0ed7041ff93fe42a852769bbd301c3cfebf
SSDEEP

24576:xzD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUYl:D6/ye0PIphrp9Zuvjqa0UidW

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe

description	pid	process	target process
PID 4964 set thread context of 4880	4964	433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe	433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe

pid	process
4880	433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe
4880	433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe
4880	433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe
4880	433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe
4880	433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe

description	pid	process	target process
PID 4964 wrote to memory of 4880	4964	433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe	433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe
PID 4964 wrote to memory of 4880	4964	433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe	433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe
PID 4964 wrote to memory of 4880	4964	433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe	433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe
PID 4964 wrote to memory of 4880	4964	433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe	433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe
PID 4964 wrote to memory of 4880	4964	433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe	433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe
PID 4964 wrote to memory of 4880	4964	433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe	433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe
PID 4964 wrote to memory of 4880	4964	433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe	433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe
PID 4964 wrote to memory of 4880	4964	433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe	433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe
PID 4964 wrote to memory of 4880	4964	433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe	433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe
PID 4964 wrote to memory of 4880	4964	433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe	433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe

C:\Users\Admin\AppData\Local\Temp\433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe
"C:\Users\Admin\AppData\Local\Temp\433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4964

C:\Users\Admin\AppData\Local\Temp\433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe
"C:\Users\Admin\AppData\Local\Temp\433263922c35a9d78afd4d7e9b939471382acf47c6ad2b3e37ec054b2bc18dc1.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:4880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4880-132-0x0000000000000000-mapping.dmp

Download
memory/4880-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4880-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4880-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4880-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4880-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4880-138-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download