240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe
Size

1.3MB
MD5

304a46a6030eb28574e76e48187d3868
SHA1

9ece017b15df364fb34e43829bb0fa1088efe1d6
SHA256

240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd
SHA512

3a19e30ac45cca9f171a38ec7a8cd01d574004a737ed3cc144b0398520a2a732d834c6168734540953a1a4dec2d223426e3e86b7e667bb5cb118e6a7a467ee16
SSDEEP

24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakt:jrKo4ZwCOnYjVmJPaW

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe

description	pid	process	target process
PID 1756 set thread context of 2552	1756	240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe	240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe

pid	process
2552	240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe
2552	240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe
2552	240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe
2552	240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe
2552	240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe

description	pid	process	target process
PID 1756 wrote to memory of 2552	1756	240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe	240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe
PID 1756 wrote to memory of 2552	1756	240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe	240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe
PID 1756 wrote to memory of 2552	1756	240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe	240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe
PID 1756 wrote to memory of 2552	1756	240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe	240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe
PID 1756 wrote to memory of 2552	1756	240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe	240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe
PID 1756 wrote to memory of 2552	1756	240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe	240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe
PID 1756 wrote to memory of 2552	1756	240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe	240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe
PID 1756 wrote to memory of 2552	1756	240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe	240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe
PID 1756 wrote to memory of 2552	1756	240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe	240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe
PID 1756 wrote to memory of 2552	1756	240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe	240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe

C:\Users\Admin\AppData\Local\Temp\240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe
"C:\Users\Admin\AppData\Local\Temp\240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1756

C:\Users\Admin\AppData\Local\Temp\240455d534ec61e522e837099b81e1908e496527fdeec5b033e4d118c304d4bd.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:2552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2552-132-0x0000000000000000-mapping.dmp

Download
memory/2552-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2552-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2552-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2552-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2552-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2552-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download