d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826

Analysis

max time kernel
177s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 16:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe
Size

71KB
MD5

45e0988e730535833c371b3849ef83d0
SHA1

fc46692fb94ea10281d939e54219b066a0543cdb
SHA256

d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826
SHA512

d084319d40eef8ba41cb7d88c1aeb3f714c3248c9bc46d1befa5b7b63812e97184c86d3856455d82c0da8df1c7697eca618fcb830740acdba44bb332533eb8e7
SSDEEP

1536:awukRGOPPXpKLqvgORYNy3G5k85ImZdSx/dZb7By5RvnN0:8kPRYNyGy8DZdSx/dZHBmR/G

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe

description	pid	process	target process
PID 4284 set thread context of 2364	4284	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exed9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe

pid	process
4284	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe
2364	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe
2364	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe

description	pid	process	target process
PID 4284 wrote to memory of 2364	4284	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe
PID 4284 wrote to memory of 2364	4284	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe
PID 4284 wrote to memory of 2364	4284	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe
PID 4284 wrote to memory of 2364	4284	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe
PID 4284 wrote to memory of 2364	4284	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe
PID 4284 wrote to memory of 2364	4284	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe
PID 4284 wrote to memory of 2364	4284	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe
PID 4284 wrote to memory of 2364	4284	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe
PID 4284 wrote to memory of 2364	4284	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe	d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe

C:\Users\Admin\AppData\Local\Temp\d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe
"C:\Users\Admin\AppData\Local\Temp\d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4284

C:\Users\Admin\AppData\Local\Temp\d9cde72289413a90bbb617d98406f90055293e8d61750af015c48841fa143826.exe
a|
2⤵
- Suspicious use of SetWindowsHookEx
PID:2364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2364-134-0x0000000000000000-mapping.dmp

Download
memory/2364-135-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2364-137-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2364-141-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download