182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed

Analysis

max time kernel
91s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe
Size

1.6MB
MD5

fd4bc0275545ce627b2de7365829e755
SHA1

fc0568994a7742a58b1d8a9bb033131e569d4021
SHA256

182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed
SHA512

3c5606d3549e3c22e4be2a6dcf3c41bab4e751858d834582334c7e0c88ddc611bc61cca8b7e3cc2b507a42d3190a50373dcdce948d20819346f301a70740730c
SSDEEP

24576:xzD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUYE:D6/ye0PIphrp9Zuvjqa0Uidj

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe

description	pid	process	target process
PID 3108 set thread context of 3920	3108	182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe	182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe

pid	process
3920	182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe
3920	182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe
3920	182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe
3920	182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe
3920	182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe

description	pid	process	target process
PID 3108 wrote to memory of 3920	3108	182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe	182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe
PID 3108 wrote to memory of 3920	3108	182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe	182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe
PID 3108 wrote to memory of 3920	3108	182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe	182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe
PID 3108 wrote to memory of 3920	3108	182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe	182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe
PID 3108 wrote to memory of 3920	3108	182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe	182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe
PID 3108 wrote to memory of 3920	3108	182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe	182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe
PID 3108 wrote to memory of 3920	3108	182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe	182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe
PID 3108 wrote to memory of 3920	3108	182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe	182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe
PID 3108 wrote to memory of 3920	3108	182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe	182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe
PID 3108 wrote to memory of 3920	3108	182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe	182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe

C:\Users\Admin\AppData\Local\Temp\182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe
"C:\Users\Admin\AppData\Local\Temp\182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3108

C:\Users\Admin\AppData\Local\Temp\182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe
"C:\Users\Admin\AppData\Local\Temp\182467a6f281108371e4d9803b6c59b556c769b4e967592d0519b538a5e9a9ed.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:3920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3920-132-0x0000000000000000-mapping.dmp

Download
memory/3920-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3920-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3920-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3920-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3920-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3920-138-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download