d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20

Analysis

max time kernel
206s
max time network
219s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 00:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe
Size

1.3MB
MD5

904b57bbfa4a2f309a7d87efe035d689
SHA1

e92fc4c02702d9331dff3def00e92ac6d75d2652
SHA256

d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20
SHA512

8098148d091c15d6c18856fb079f2edcefbbdc100ffb7426308b48a8295cd57e3878fe35fa9ec72fbb0bd351e1d5d7fb239ada93062bee1d83a01a1b82f311f4
SSDEEP

24576:EpyhP5RFFrSEyFPu8JR9ksaQFCLwbLflBP9:LyFPu8D9k5QELuLV

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe

description	pid	process	target process
PID 1332 set thread context of 3384	1332	d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe	d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe

pid	process
3384	d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe
3384	d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe
3384	d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe
3384	d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe
3384	d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe

description	pid	process	target process
PID 1332 wrote to memory of 3384	1332	d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe	d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe
PID 1332 wrote to memory of 3384	1332	d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe	d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe
PID 1332 wrote to memory of 3384	1332	d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe	d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe
PID 1332 wrote to memory of 3384	1332	d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe	d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe
PID 1332 wrote to memory of 3384	1332	d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe	d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe
PID 1332 wrote to memory of 3384	1332	d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe	d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe
PID 1332 wrote to memory of 3384	1332	d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe	d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe
PID 1332 wrote to memory of 3384	1332	d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe	d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe
PID 1332 wrote to memory of 3384	1332	d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe	d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe
PID 1332 wrote to memory of 3384	1332	d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe	d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe

C:\Users\Admin\AppData\Local\Temp\d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe
"C:\Users\Admin\AppData\Local\Temp\d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1332

C:\Users\Admin\AppData\Local\Temp\d2077d9c3b42a2ff7e212801e37fefae4329e9c0640809a7fbe8550e045b9a20.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:3384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3384-132-0x0000000000000000-mapping.dmp

Download
memory/3384-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3384-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3384-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3384-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3384-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3384-138-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download