d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99

Analysis

max time kernel
181s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 00:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe
Size

1.3MB
MD5

f672a0ccb0dcdc8c4ba56537a6513b50
SHA1

4a34aca576ff579308b1a673435ccf13bc43776f
SHA256

d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99
SHA512

4f27bd26fa247913115e0081d380b99feedbbc05d0feac72394874bf015739ccd78ce02b5851a45d6a93e8ce83c50f7a22851878cbcc0fcbe3d60473f77b0714
SSDEEP

24576:VpyhP5RFFrSEyFPu8JR9ksaQFCLwbLflBP1:yyFPu8D9k5QELuLN

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe

description	pid	process	target process
PID 2000 set thread context of 4120	2000	d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe	d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe

pid	process
4120	d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe
4120	d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe
4120	d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe
4120	d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe
4120	d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe

description	pid	process	target process
PID 2000 wrote to memory of 4120	2000	d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe	d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe
PID 2000 wrote to memory of 4120	2000	d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe	d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe
PID 2000 wrote to memory of 4120	2000	d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe	d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe
PID 2000 wrote to memory of 4120	2000	d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe	d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe
PID 2000 wrote to memory of 4120	2000	d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe	d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe
PID 2000 wrote to memory of 4120	2000	d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe	d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe
PID 2000 wrote to memory of 4120	2000	d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe	d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe
PID 2000 wrote to memory of 4120	2000	d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe	d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe
PID 2000 wrote to memory of 4120	2000	d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe	d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe
PID 2000 wrote to memory of 4120	2000	d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe	d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe

C:\Users\Admin\AppData\Local\Temp\d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe
"C:\Users\Admin\AppData\Local\Temp\d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2000

C:\Users\Admin\AppData\Local\Temp\d91d550c04865346aa25c3af4e981d20ddb2f6046bbdd558a02283ff1a6c2e99.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4120-132-0x0000000000000000-mapping.dmp

Download
memory/4120-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4120-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4120-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4120-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4120-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download