Analysis

  • max time kernel
    157s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2022 00:28

General

  • Target

    22e6fef1cc5f298ec94ed5fb51445fda30ea8fbf66dd874694063a8453f9fb72.exe

  • Size

    1.3MB

  • MD5

    1ad1dc213be7f24561a675178ffd4c35

  • SHA1

    ebc31d1ad3f2d0972edf3b462ec2b4da502a7e44

  • SHA256

    22e6fef1cc5f298ec94ed5fb51445fda30ea8fbf66dd874694063a8453f9fb72

  • SHA512

    0c4472f2895fcfb8ebc15f6d4eb6d73a5add4f9fab5e147ff983ea768a5c446dda11efd878e65563cc055b06ca246b6bc6a1f893d6308f26c6304933f2475a91

  • SSDEEP

    24576:2KyKz4D4ufmwhzA2QoPKCys7JdpmnMlxy9KR8uQcu3:2KVzMNuwIKyoBmnMSURNQX

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\22e6fef1cc5f298ec94ed5fb51445fda30ea8fbf66dd874694063a8453f9fb72.exe
    "C:\Users\Admin\AppData\Local\Temp\22e6fef1cc5f298ec94ed5fb51445fda30ea8fbf66dd874694063a8453f9fb72.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3732
    • C:\Users\Admin\AppData\Local\Temp\22e6fef1cc5f298ec94ed5fb51445fda30ea8fbf66dd874694063a8453f9fb72.exe
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:2472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2472-132-0x0000000000000000-mapping.dmp

  • memory/2472-133-0x0000000000400000-0x00000000004D8000-memory.dmp

    Filesize

    864KB

  • memory/2472-134-0x0000000000400000-0x00000000004D8000-memory.dmp

    Filesize

    864KB

  • memory/2472-135-0x0000000000400000-0x00000000004D8000-memory.dmp

    Filesize

    864KB

  • memory/2472-136-0x0000000000400000-0x00000000004D8000-memory.dmp

    Filesize

    864KB

  • memory/2472-137-0x0000000000400000-0x00000000004D8000-memory.dmp

    Filesize

    864KB

  • memory/2472-138-0x0000000000400000-0x00000000004D8000-memory.dmp

    Filesize

    864KB