3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de

Analysis

max time kernel
185s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe
Size

1.3MB
MD5

cbb82f41a5f798f549ec70432936c276
SHA1

01dd177239fc011bdb24e01a757c523080cd4471
SHA256

3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de
SHA512

d61e4513d3ba8de2edc70e6901acb3f54fc9ffd81a58bcdd9f54e11d7a76f542a0cd20b7811fa81c397375418b7691caeab8732655fe3fb38b925d694803a5a6
SSDEEP

24576:brKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakK:brKo4ZwCOnYjVmJPaR

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe

description	pid	process	target process
PID 2580 set thread context of 2856	2580	3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe	3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe

pid	process
2856	3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe
2856	3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe
2856	3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe
2856	3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe
2856	3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe

description	pid	process	target process
PID 2580 wrote to memory of 2856	2580	3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe	3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe
PID 2580 wrote to memory of 2856	2580	3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe	3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe
PID 2580 wrote to memory of 2856	2580	3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe	3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe
PID 2580 wrote to memory of 2856	2580	3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe	3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe
PID 2580 wrote to memory of 2856	2580	3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe	3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe
PID 2580 wrote to memory of 2856	2580	3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe	3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe
PID 2580 wrote to memory of 2856	2580	3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe	3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe
PID 2580 wrote to memory of 2856	2580	3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe	3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe
PID 2580 wrote to memory of 2856	2580	3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe	3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe
PID 2580 wrote to memory of 2856	2580	3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe	3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe

C:\Users\Admin\AppData\Local\Temp\3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe
"C:\Users\Admin\AppData\Local\Temp\3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2580

C:\Users\Admin\AppData\Local\Temp\3e2d1d8baca59965e9170979a05089815fcb072b60dfee0e849ad3f7fae273de.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:2856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2856-132-0x0000000000000000-mapping.dmp

Download
memory/2856-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2856-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2856-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2856-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2856-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download