ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e

Analysis

max time kernel
169s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 07:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe
Size

1.3MB
MD5

a3f6e65f8f5020c8a3ca3ed3e31a8f9d
SHA1

18b895e04178bf413f7c8ced357ae5aeb000d726
SHA256

ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e
SHA512

6b517fc9561662f5d193efa529ac03b4f4e909c6c77b8cce53ee22664ee451d823a44bb3d2680ffdac0062d48494fbd1195f1af9a290ee45fc857d35d1138a0e
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPaku:7rKo4ZwCOnYjVmJPaJ

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe

description	pid	process	target process
PID 2132 set thread context of 4980	2132	ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe	ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe

pid	process
4980	ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe
4980	ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe
4980	ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe
4980	ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe
4980	ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe

description	pid	process	target process
PID 2132 wrote to memory of 4980	2132	ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe	ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe
PID 2132 wrote to memory of 4980	2132	ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe	ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe
PID 2132 wrote to memory of 4980	2132	ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe	ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe
PID 2132 wrote to memory of 4980	2132	ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe	ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe
PID 2132 wrote to memory of 4980	2132	ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe	ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe
PID 2132 wrote to memory of 4980	2132	ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe	ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe
PID 2132 wrote to memory of 4980	2132	ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe	ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe
PID 2132 wrote to memory of 4980	2132	ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe	ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe
PID 2132 wrote to memory of 4980	2132	ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe	ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe
PID 2132 wrote to memory of 4980	2132	ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe	ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe

C:\Users\Admin\AppData\Local\Temp\ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe
"C:\Users\Admin\AppData\Local\Temp\ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2132

C:\Users\Admin\AppData\Local\Temp\ff9080eba7d3e34cc4bdfcbd6692ce17b4b2d8a3390953073cfe1c0d67d43a2e.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4980-132-0x0000000000000000-mapping.dmp

Download
memory/4980-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4980-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4980-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4980-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4980-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4980-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download