66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203

Analysis

max time kernel
216s
max time network
237s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 00:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe
Size

1.2MB
MD5

565adb2d8bf393e5dc8750a8a9c40ab3
SHA1

b279db1d09227720cfb9b936ddb1340fe98b396a
SHA256

66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203
SHA512

f92856c7ff5a0593bbbc773e7166985a638e2668a03be139351f364263956d9dc45a6ac22fc723a3a8bce726722634133e93fe6d258d7750434f41f531da4a8d
SSDEEP

24576:JbkiGUv38BEDWRR2cU1kPLtOF5Tr287ZTPcyAKYP+y42CO:+qvCEaRkca2Yb/3PmKxqH

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe

description	pid	process	target process
PID 3336 set thread context of 3852	3336	66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe	66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe

pid	process
3852	66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe
3852	66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe
3852	66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe
3852	66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe
3852	66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe

description	pid	process	target process
PID 3336 wrote to memory of 3852	3336	66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe	66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe
PID 3336 wrote to memory of 3852	3336	66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe	66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe
PID 3336 wrote to memory of 3852	3336	66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe	66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe
PID 3336 wrote to memory of 3852	3336	66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe	66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe
PID 3336 wrote to memory of 3852	3336	66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe	66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe
PID 3336 wrote to memory of 3852	3336	66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe	66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe
PID 3336 wrote to memory of 3852	3336	66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe	66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe
PID 3336 wrote to memory of 3852	3336	66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe	66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe
PID 3336 wrote to memory of 3852	3336	66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe	66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe
PID 3336 wrote to memory of 3852	3336	66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe	66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe

C:\Users\Admin\AppData\Local\Temp\66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe
"C:\Users\Admin\AppData\Local\Temp\66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3336

C:\Users\Admin\AppData\Local\Temp\66f2be45a80f14e239a0b5588c6dce758380ae35e558606baae997bc2895d203.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:3852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3852-132-0x0000000000000000-mapping.dmp

Download
memory/3852-133-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/3852-134-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/3852-135-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/3852-136-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/3852-137-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/3852-138-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download