d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011

Analysis

max time kernel
90s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 07:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe
Size

1.4MB
MD5

eefa11da88a5eb7931e1d102a040b2f8
SHA1

9168a81ba53807dad0c2052da921248cc64a4245
SHA256

d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011
SHA512

1aa43f14e1fe38bd06df0708efda12867c089884f0ce3c36c1d3a1aa6c8c89aadc37062be635e61ea43099108fffe9e0596a2b465f91a20a1cf91c1f5a793a25
SSDEEP

24576:hrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8Ak:hrBew72604doSw6ewH

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe

description	pid	process	target process
PID 648 set thread context of 4796	648	d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe	d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe

pid	process
4796	d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe
4796	d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe
4796	d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe
4796	d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe
4796	d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe

description	pid	process	target process
PID 648 wrote to memory of 4796	648	d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe	d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe
PID 648 wrote to memory of 4796	648	d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe	d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe
PID 648 wrote to memory of 4796	648	d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe	d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe
PID 648 wrote to memory of 4796	648	d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe	d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe
PID 648 wrote to memory of 4796	648	d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe	d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe
PID 648 wrote to memory of 4796	648	d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe	d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe
PID 648 wrote to memory of 4796	648	d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe	d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe
PID 648 wrote to memory of 4796	648	d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe	d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe
PID 648 wrote to memory of 4796	648	d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe	d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe
PID 648 wrote to memory of 4796	648	d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe	d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe

C:\Users\Admin\AppData\Local\Temp\d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe
"C:\Users\Admin\AppData\Local\Temp\d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:648

C:\Users\Admin\AppData\Local\Temp\d53f506ccc951d59e5ea5a4cddba62ab6b588261f32fab08c6a8f2e8efba8011.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4796-132-0x0000000000000000-mapping.dmp

Download
memory/4796-133-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/4796-134-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/4796-135-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/4796-136-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/4796-137-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download