8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb

Analysis

max time kernel
187s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 16:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe
Size

240KB
MD5

3190ff5d6a10ae23c287461620fb60f6
SHA1

7dbab456f5f49ec478a5760dbbc02d2e94572270
SHA256

8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb
SHA512

256957c6d9bc8ef5f8b9758b9294e5bdc352a64a785e829b203d087695efb13b1d5cb6807711c546721ca5f53590ce9110833283754b071fb3e8c584583af881
SSDEEP

3072:I2tgYhx2fEbUVwogZfYagZfYAgZfYlCxdw3SC6:DMVAZwZZwLZwledwA

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe

description	pid	process	target process
PID 2204 set thread context of 3064	2204	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe

pid	process
3064	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe
3064	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe
3064	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe
3064	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe

pid process

2204 8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe

pid	process
2204	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe

description	pid	process	target process
PID 2204 wrote to memory of 3064	2204	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe
PID 2204 wrote to memory of 3064	2204	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe
PID 2204 wrote to memory of 3064	2204	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe
PID 2204 wrote to memory of 3064	2204	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe
PID 2204 wrote to memory of 3064	2204	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe
PID 2204 wrote to memory of 3064	2204	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe
PID 2204 wrote to memory of 3064	2204	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe
PID 3064 wrote to memory of 2584	3064	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe	Explorer.EXE
PID 3064 wrote to memory of 2584	3064	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe	Explorer.EXE
PID 3064 wrote to memory of 2584	3064	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe	Explorer.EXE
PID 3064 wrote to memory of 2584	3064	8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2584
- C:\Users\Admin\AppData\Local\Temp\8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe
  "C:\Users\Admin\AppData\Local\Temp\8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Users\Admin\AppData\Local\Temp\8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe
    "C:\Users\Admin\AppData\Local\Temp\8edf36fecb97ce6d1398c3e19948a4cae773a14fb235f7af26576a113a8e33cb.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2584-139-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3064-134-0x0000000000000000-mapping.dmp

Download
memory/3064-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3064-137-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3064-138-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3064-140-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3064-141-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download