1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34

Analysis

max time kernel
166s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe
Size

1.3MB
MD5

4789af9bca3660021f3a340d5d559a80
SHA1

0438d7a37a9986495721c1dd3c82d3a952837dbe
SHA256

1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34
SHA512

e0bbf91e0928701505cf007701fac96eeec58d77ad0960d3ff196affea384e084b49071f06fe726c51bdcadad91a10dd38a5b090ef78045c64a4550f76093aab
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakR:zrKo4ZwCOnYjVmJPa2

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe

description	pid	process	target process
PID 4300 set thread context of 652	4300	1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe	1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe

pid	process
652	1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe
652	1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe
652	1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe
652	1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe
652	1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe

description	pid	process	target process
PID 4300 wrote to memory of 652	4300	1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe	1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe
PID 4300 wrote to memory of 652	4300	1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe	1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe
PID 4300 wrote to memory of 652	4300	1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe	1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe
PID 4300 wrote to memory of 652	4300	1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe	1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe
PID 4300 wrote to memory of 652	4300	1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe	1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe
PID 4300 wrote to memory of 652	4300	1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe	1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe
PID 4300 wrote to memory of 652	4300	1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe	1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe
PID 4300 wrote to memory of 652	4300	1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe	1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe
PID 4300 wrote to memory of 652	4300	1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe	1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe
PID 4300 wrote to memory of 652	4300	1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe	1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe

C:\Users\Admin\AppData\Local\Temp\1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe
"C:\Users\Admin\AppData\Local\Temp\1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4300

C:\Users\Admin\AppData\Local\Temp\1d656c8c119f957a2d319c0eb2e86720d5696e38d312db5b40a2a96bc1f87d34.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/652-132-0x0000000000000000-mapping.dmp

Download
memory/652-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/652-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/652-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/652-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/652-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download