d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81

Analysis

max time kernel
182s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 07:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe
Size

1.4MB
MD5

f8217c273f7d0bb3e59b35cd99707781
SHA1

77726e6391e79b94386a8d9061bc6bc0c27a7a4f
SHA256

d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81
SHA512

64bd53daa41acf31a8e6185e96dafd22e0bd1a56ec8a79313b597aa2638bb85cde5b63d76f3a78d906dc82794222685a4f6f224e52ec789ee3c373fde3a01b8c
SSDEEP

24576:BrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8AP:BrBew72604doSw6ew0

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe

description	pid	process	target process
PID 4956 set thread context of 216	4956	d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe	d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe

pid	process
216	d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe
216	d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe
216	d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe
216	d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe
216	d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe

description	pid	process	target process
PID 4956 wrote to memory of 216	4956	d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe	d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe
PID 4956 wrote to memory of 216	4956	d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe	d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe
PID 4956 wrote to memory of 216	4956	d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe	d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe
PID 4956 wrote to memory of 216	4956	d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe	d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe
PID 4956 wrote to memory of 216	4956	d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe	d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe
PID 4956 wrote to memory of 216	4956	d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe	d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe
PID 4956 wrote to memory of 216	4956	d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe	d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe
PID 4956 wrote to memory of 216	4956	d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe	d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe
PID 4956 wrote to memory of 216	4956	d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe	d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe
PID 4956 wrote to memory of 216	4956	d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe	d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe

C:\Users\Admin\AppData\Local\Temp\d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe
"C:\Users\Admin\AppData\Local\Temp\d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4956

C:\Users\Admin\AppData\Local\Temp\d3028a4d64c20d592fe2c319bfc3694c601211a164396c044ccc2065cc3aad81.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/216-132-0x0000000000000000-mapping.dmp

Download
memory/216-133-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/216-134-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/216-135-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/216-136-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/216-137-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download