fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86

Analysis

max time kernel
166s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 08:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe
Size

1.3MB
MD5

4e34b8c51efe67d30bd8f935a0ea2862
SHA1

4976c4f721806edefc453b082f27120cf4a8732a
SHA256

fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86
SHA512

cf9e44fedb9af1ad2155cf258911546361132f005fca1c3d2e73aced0cf241777f3d404f4a2a9a3234dd850a7c30b3b8c168a7d0c7d93e56b7cff8ef1adf44f7
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak7:TrKo4ZwCOnYjVmJPaw

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe

description	pid	process	target process
PID 1016 set thread context of 2424	1016	fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe	fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe

pid	process
2424	fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe
2424	fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe
2424	fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe
2424	fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe
2424	fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe

description	pid	process	target process
PID 1016 wrote to memory of 2424	1016	fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe	fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe
PID 1016 wrote to memory of 2424	1016	fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe	fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe
PID 1016 wrote to memory of 2424	1016	fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe	fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe
PID 1016 wrote to memory of 2424	1016	fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe	fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe
PID 1016 wrote to memory of 2424	1016	fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe	fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe
PID 1016 wrote to memory of 2424	1016	fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe	fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe
PID 1016 wrote to memory of 2424	1016	fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe	fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe
PID 1016 wrote to memory of 2424	1016	fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe	fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe
PID 1016 wrote to memory of 2424	1016	fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe	fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe
PID 1016 wrote to memory of 2424	1016	fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe	fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe

C:\Users\Admin\AppData\Local\Temp\fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe
"C:\Users\Admin\AppData\Local\Temp\fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1016

C:\Users\Admin\AppData\Local\Temp\fb0c9198f4ebda1f84f94765cc50166bbb4bf752ea85d3d969563c39ca793e86.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:2424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2424-132-0x0000000000000000-mapping.dmp

Download
memory/2424-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2424-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2424-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2424-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2424-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download