Analysis
-
max time kernel
396s -
max time network
441s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 15:59
Static task
static1
Behavioral task
behavioral1
Sample
灵域DLL函数查看器2.1.exe
Resource
win7-20221111-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
灵域DLL函数查看器2.1.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
灵域DLL函数查看器2.1.exe
-
Size
1.6MB
-
MD5
d725e61af5a2f4970c9719639433d724
-
SHA1
03cabb47fdf087cea32cd71c3f01897ed020d816
-
SHA256
f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd
-
SHA512
a8188db27150531154d324e3b5c19f72d05bd45beb9cb169825a5fc1abee3136bfc149072f29c6566594db2e8313ebed448f8995020f6d32dbe30de7f72dfd24
-
SSDEEP
24576:0oNtDHP3owgLIaIEt8GRDBbFzgfoM3q4at2au5AvprYaTmo2jb6RZfsLypvIH3R:0ADHLgLPt8eTV4QooZfWovIH3R
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
Processes:
灵域DLL函数查看器2.1.exepid process 3552 灵域DLL函数查看器2.1.exe 3552 灵域DLL函数查看器2.1.exe 3552 灵域DLL函数查看器2.1.exe 3552 灵域DLL函数查看器2.1.exe 3552 灵域DLL函数查看器2.1.exe 3552 灵域DLL函数查看器2.1.exe 3552 灵域DLL函数查看器2.1.exe 3552 灵域DLL函数查看器2.1.exe 3552 灵域DLL函数查看器2.1.exe 3552 灵域DLL函数查看器2.1.exe 3552 灵域DLL函数查看器2.1.exe 3552 灵域DLL函数查看器2.1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
灵域DLL函数查看器2.1.exepid process 3552 灵域DLL函数查看器2.1.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3552-132-0x0000000000400000-0x0000000000625000-memory.dmpFilesize
2.1MB
-
memory/3552-133-0x0000000077150000-0x00000000772F3000-memory.dmpFilesize
1.6MB
-
memory/3552-134-0x00000000752B0000-0x00000000754C5000-memory.dmpFilesize
2.1MB
-
memory/3552-136-0x0000000076DE0000-0x0000000076F80000-memory.dmpFilesize
1.6MB
-
memory/3552-137-0x0000000077050000-0x00000000770CA000-memory.dmpFilesize
488KB
-
memory/3552-1479-0x0000000000400000-0x0000000000625000-memory.dmpFilesize
2.1MB
-
memory/3552-1480-0x0000000000400000-0x0000000000625000-memory.dmpFilesize
2.1MB
-
memory/3552-1481-0x0000000000400000-0x0000000000625000-memory.dmpFilesize
2.1MB
-
memory/3552-1482-0x0000000000400000-0x0000000000625000-memory.dmpFilesize
2.1MB
-
memory/3552-1483-0x0000000000400000-0x0000000000625000-memory.dmpFilesize
2.1MB
-
memory/3552-1485-0x0000000000400000-0x0000000000625000-memory.dmpFilesize
2.1MB
-
memory/3552-1486-0x0000000000400000-0x0000000000625000-memory.dmpFilesize
2.1MB