1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe
Size

1.3MB
MD5

a038847768d429035efaa8e47b952ae7
SHA1

84a7bcb3ccf5d569da50fa175b314c90a0a9e5ae
SHA256

1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a
SHA512

123fbd4c4225140bd60244558bf42cd4dee778af9d0359f40f3575c57ae3e931ea305d0aacf315bf82cc23bcd6be99f052d8a618d1b1d0f3c117384a522f1715
SSDEEP

24576:DrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak:DrKo4ZwCOnYjVmJPa

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe

description	pid	process	target process
PID 4964 set thread context of 1968	4964	1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe	1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe

pid	process
1968	1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe
1968	1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe
1968	1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe
1968	1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe
1968	1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe

description	pid	process	target process
PID 4964 wrote to memory of 1968	4964	1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe	1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe
PID 4964 wrote to memory of 1968	4964	1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe	1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe
PID 4964 wrote to memory of 1968	4964	1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe	1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe
PID 4964 wrote to memory of 1968	4964	1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe	1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe
PID 4964 wrote to memory of 1968	4964	1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe	1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe
PID 4964 wrote to memory of 1968	4964	1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe	1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe
PID 4964 wrote to memory of 1968	4964	1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe	1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe
PID 4964 wrote to memory of 1968	4964	1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe	1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe
PID 4964 wrote to memory of 1968	4964	1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe	1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe
PID 4964 wrote to memory of 1968	4964	1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe	1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe

C:\Users\Admin\AppData\Local\Temp\1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe
"C:\Users\Admin\AppData\Local\Temp\1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4964

C:\Users\Admin\AppData\Local\Temp\1a69597f0949e10f7a1d24455642f1c83c61d42a0e4bbda2c9848e9a12e3400a.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:1968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-135-0x0000000000000000-mapping.dmp

Download
memory/1968-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1968-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1968-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1968-139-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1968-140-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download