19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881

Analysis

max time kernel
186s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe
Size

1.3MB
MD5

74414557de443c94c83ea997ce143cdd
SHA1

39bbfa3d7c82e9f225c5cf516a2c10574a2ae075
SHA256

19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881
SHA512

e92faa74174f7cff54e60c2406a52c97044dbc2604968a620aad0fff00c1cf6d1e40e35422d9ae9d046712f641ed9b1daa3b56c25dbbbb328f8f21c4169484dd
SSDEEP

24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakN:jrKo4ZwCOnYjVmJPae

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe

description	pid	process	target process
PID 4376 set thread context of 5108	4376	19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe	19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe

pid	process
5108	19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe
5108	19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe
5108	19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe
5108	19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe
5108	19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe

description	pid	process	target process
PID 4376 wrote to memory of 5108	4376	19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe	19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe
PID 4376 wrote to memory of 5108	4376	19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe	19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe
PID 4376 wrote to memory of 5108	4376	19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe	19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe
PID 4376 wrote to memory of 5108	4376	19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe	19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe
PID 4376 wrote to memory of 5108	4376	19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe	19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe
PID 4376 wrote to memory of 5108	4376	19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe	19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe
PID 4376 wrote to memory of 5108	4376	19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe	19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe
PID 4376 wrote to memory of 5108	4376	19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe	19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe
PID 4376 wrote to memory of 5108	4376	19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe	19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe
PID 4376 wrote to memory of 5108	4376	19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe	19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe

C:\Users\Admin\AppData\Local\Temp\19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe
"C:\Users\Admin\AppData\Local\Temp\19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4376

C:\Users\Admin\AppData\Local\Temp\19123b03c2c31af7e626cec57361a221dc5e288daaed78bf2a1e7567647e8881.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:5108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5108-132-0x0000000000000000-mapping.dmp

Download
memory/5108-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/5108-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/5108-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/5108-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/5108-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download