20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c

Analysis

max time kernel
314s
max time network
406s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe
Size

1.3MB
MD5

7d5ea1e94c5c4e57bdb841ff494e0c21
SHA1

c8857408b5d1ea12f18955c6ee619684b62853f5
SHA256

20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c
SHA512

a0a358957057352d81d2978a09494a27917be0cec6cfb1c70aa4c89db23ce9ba92ee82398880f6bdb36eecbf66b9cd46c1af12cf76d88cb63a52ab656bdb971b
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak7:TrKo4ZwCOnYjVmJPaU

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe

description	pid	process	target process
PID 808 set thread context of 524	808	20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe	20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe

pid	process
524	20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe
524	20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe
524	20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe
524	20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe
524	20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe

description	pid	process	target process
PID 808 wrote to memory of 524	808	20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe	20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe
PID 808 wrote to memory of 524	808	20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe	20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe
PID 808 wrote to memory of 524	808	20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe	20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe
PID 808 wrote to memory of 524	808	20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe	20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe
PID 808 wrote to memory of 524	808	20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe	20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe
PID 808 wrote to memory of 524	808	20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe	20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe
PID 808 wrote to memory of 524	808	20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe	20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe
PID 808 wrote to memory of 524	808	20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe	20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe
PID 808 wrote to memory of 524	808	20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe	20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe
PID 808 wrote to memory of 524	808	20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe	20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe

C:\Users\Admin\AppData\Local\Temp\20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe
"C:\Users\Admin\AppData\Local\Temp\20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:808

C:\Users\Admin\AppData\Local\Temp\20705553ba4dab31432b8268401c298434e60dceb1addef25323863be209666c.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/524-132-0x0000000000000000-mapping.dmp

Download
memory/524-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/524-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/524-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/524-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/524-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download