1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54

Analysis

max time kernel
152s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe
Size

1.3MB
MD5

4de8f60fa0b473a8479227b69f224127
SHA1

bab6c4e2752bb1d1a13ddc3b2700a1af2bd48ce5
SHA256

1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54
SHA512

ae9684202a7608dba3c7e513960628e2f6e0ab893fe24833bfc8dd4eade913602c369026705354f7b2013741ee1f1fba0ca031c29619992fd925b89f962f2f29
SSDEEP

24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakG:jrKo4ZwCOnYjVmJPaZ

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe

description	pid	process	target process
PID 336 set thread context of 3616	336	1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe	1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe

pid	process
3616	1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe
3616	1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe
3616	1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe
3616	1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe
3616	1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe

description	pid	process	target process
PID 336 wrote to memory of 3616	336	1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe	1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe
PID 336 wrote to memory of 3616	336	1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe	1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe
PID 336 wrote to memory of 3616	336	1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe	1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe
PID 336 wrote to memory of 3616	336	1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe	1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe
PID 336 wrote to memory of 3616	336	1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe	1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe
PID 336 wrote to memory of 3616	336	1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe	1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe
PID 336 wrote to memory of 3616	336	1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe	1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe
PID 336 wrote to memory of 3616	336	1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe	1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe
PID 336 wrote to memory of 3616	336	1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe	1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe
PID 336 wrote to memory of 3616	336	1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe	1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe

C:\Users\Admin\AppData\Local\Temp\1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe
"C:\Users\Admin\AppData\Local\Temp\1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:336

C:\Users\Admin\AppData\Local\Temp\1a665c35e2d4ef925800434a3eb68616b329de9d4e4ca7d0030bcf7a9bc2ce54.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:3616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3616-132-0x0000000000000000-mapping.dmp

Download
memory/3616-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3616-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3616-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3616-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3616-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download