fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b

Analysis

max time kernel
216s
max time network
251s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 00:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe
Size

1.5MB
MD5

6eb7e561373de933b89624be5c009eb5
SHA1

dc214f7c778b694e473d11261423a2d57502cba1
SHA256

fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b
SHA512

2829d5c5d43d28ca7c6c609c35fa63f4de4c063c5ce2af0cd968d3c013ab7a6c0a3573df22f0c386e6e2cc960a94114915b93cf753c9d430bd882eeb88aa9db0
SSDEEP

24576:rPEzeDWtazKrcVWv+FjisSOZYjmOdXQ+ARZoQWnQUwMlds0VwI/9MU:rIwwImsMqQA57oQWcGdsy1

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe

description	pid	process	target process
PID 4524 set thread context of 5040	4524	fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe	fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe

pid	process
5040	fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe
5040	fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe
5040	fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe
5040	fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe
5040	fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe

description	pid	process	target process
PID 4524 wrote to memory of 5040	4524	fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe	fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe
PID 4524 wrote to memory of 5040	4524	fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe	fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe
PID 4524 wrote to memory of 5040	4524	fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe	fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe
PID 4524 wrote to memory of 5040	4524	fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe	fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe
PID 4524 wrote to memory of 5040	4524	fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe	fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe
PID 4524 wrote to memory of 5040	4524	fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe	fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe
PID 4524 wrote to memory of 5040	4524	fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe	fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe
PID 4524 wrote to memory of 5040	4524	fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe	fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe
PID 4524 wrote to memory of 5040	4524	fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe	fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe
PID 4524 wrote to memory of 5040	4524	fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe	fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe

C:\Users\Admin\AppData\Local\Temp\fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe
"C:\Users\Admin\AppData\Local\Temp\fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4524

C:\Users\Admin\AppData\Local\Temp\fe6144664c4d84ec7b02400534c017c38b839b1e7128ccf03420e23ab367569b.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:5040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5040-132-0x0000000000000000-mapping.dmp

Download
memory/5040-133-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/5040-134-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/5040-135-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/5040-136-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download