42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec

Analysis

max time kernel
74s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe
Size

1.3MB
MD5

19b817f7b0472dad715670094757fe37
SHA1

653be09954d73f1228aad04472e43e8f454f2847
SHA256

42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec
SHA512

f5d0457d97a3b0a983ede355c75e03cf021afab693905e864e5a01b84edf845b38874571b2aba21ff5585f2a7ddc5e762e480970c5e1e772735596ebed4eb480
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakq:7rKo4ZwCOnYjVmJPaR

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe

description	pid	process	target process
PID 3068 set thread context of 3284	3068	42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe	42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe

pid	process
3284	42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe
3284	42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe
3284	42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe
3284	42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe
3284	42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe

description	pid	process	target process
PID 3068 wrote to memory of 3284	3068	42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe	42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe
PID 3068 wrote to memory of 3284	3068	42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe	42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe
PID 3068 wrote to memory of 3284	3068	42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe	42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe
PID 3068 wrote to memory of 3284	3068	42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe	42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe
PID 3068 wrote to memory of 3284	3068	42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe	42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe
PID 3068 wrote to memory of 3284	3068	42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe	42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe
PID 3068 wrote to memory of 3284	3068	42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe	42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe
PID 3068 wrote to memory of 3284	3068	42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe	42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe
PID 3068 wrote to memory of 3284	3068	42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe	42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe
PID 3068 wrote to memory of 3284	3068	42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe	42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe

C:\Users\Admin\AppData\Local\Temp\42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe
"C:\Users\Admin\AppData\Local\Temp\42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\42ba631b0844064eff72416bdef3d8059084b60ed351855ef2d74e7256bfb6ec.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3284-132-0x0000000000000000-mapping.dmp

Download
memory/3284-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3284-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3284-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3284-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3284-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download