fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 08:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe
Size

1.3MB
MD5

e6bb0277feeae5acf4b44f07737c927d
SHA1

6411b125516711a1cc05809568b1359efa08b22b
SHA256

fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee
SHA512

48bb0f47da8ef3f9679ea0459c42d71cf6cde1fb5ebc5f73de85d8d0d5211b16c59f96ade5f715024e914053d827eb222efd41056c1c26ba4044611f591da94f
SSDEEP

24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakA:jrKo4ZwCOnYjVmJPa/

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe

description	pid	process	target process
PID 5112 set thread context of 644	5112	fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe	fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe

pid	process
644	fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe
644	fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe
644	fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe
644	fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe
644	fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe

description	pid	process	target process
PID 5112 wrote to memory of 644	5112	fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe	fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe
PID 5112 wrote to memory of 644	5112	fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe	fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe
PID 5112 wrote to memory of 644	5112	fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe	fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe
PID 5112 wrote to memory of 644	5112	fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe	fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe
PID 5112 wrote to memory of 644	5112	fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe	fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe
PID 5112 wrote to memory of 644	5112	fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe	fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe
PID 5112 wrote to memory of 644	5112	fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe	fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe
PID 5112 wrote to memory of 644	5112	fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe	fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe
PID 5112 wrote to memory of 644	5112	fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe	fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe
PID 5112 wrote to memory of 644	5112	fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe	fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe

C:\Users\Admin\AppData\Local\Temp\fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe
"C:\Users\Admin\AppData\Local\Temp\fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5112

C:\Users\Admin\AppData\Local\Temp\fbb7e51c92c9ac3a980b2462130bedd6a84006798dd1868754838f6fbd13ebee.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/644-132-0x0000000000000000-mapping.dmp

Download
memory/644-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/644-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/644-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/644-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/644-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download