1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe

Analysis

max time kernel
152s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe
Size

1.3MB
MD5

da04339a18709950e311660a05a36537
SHA1

763d4e99a5cec1973b883f3145e879c87548f7dd
SHA256

1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe
SHA512

254bd5108624d8f8117718c63f00b0b5f718889f51fa42779a819924c7a2603460792cda6db7bede3c42f3359df8ec0707341872905f37b196b119f9a97e86d2
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakf:7rKo4ZwCOnYjVmJPa8

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe

description	pid	process	target process
PID 1624 set thread context of 4108	1624	1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe	1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe

pid	process
4108	1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe
4108	1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe
4108	1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe
4108	1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe
4108	1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe

description	pid	process	target process
PID 1624 wrote to memory of 4108	1624	1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe	1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe
PID 1624 wrote to memory of 4108	1624	1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe	1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe
PID 1624 wrote to memory of 4108	1624	1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe	1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe
PID 1624 wrote to memory of 4108	1624	1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe	1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe
PID 1624 wrote to memory of 4108	1624	1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe	1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe
PID 1624 wrote to memory of 4108	1624	1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe	1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe
PID 1624 wrote to memory of 4108	1624	1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe	1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe
PID 1624 wrote to memory of 4108	1624	1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe	1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe
PID 1624 wrote to memory of 4108	1624	1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe	1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe
PID 1624 wrote to memory of 4108	1624	1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe	1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe

C:\Users\Admin\AppData\Local\Temp\1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe
"C:\Users\Admin\AppData\Local\Temp\1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1624

C:\Users\Admin\AppData\Local\Temp\1f572dbb4055b6d5e77b042230a1290e90b844a2def7a0c15055024eb7ccfdbe.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4108-132-0x0000000000000000-mapping.dmp

Download
memory/4108-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4108-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4108-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4108-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4108-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download