ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1

Analysis

max time kernel
152s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 07:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe
Size

1.3MB
MD5

3d4212bc2aa0fe292b26876f63ec59ba
SHA1

b5c36fa9e94c12bd748ab03a67909f1166d4622f
SHA256

ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1
SHA512

bb3f1a12ae4295e8ac84e76a3b77968f523677b669ecb68a4638e3654efb982c8ecc52a12dc18f7c52314939869c3e94424d9890f40a6724a6151ce58ae32c23
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakC:zrKo4ZwCOnYjVmJPap

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe

description	pid	process	target process
PID 1096 set thread context of 1512	1096	ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe	ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe

pid	process
1512	ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe
1512	ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe
1512	ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe
1512	ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe
1512	ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe

description	pid	process	target process
PID 1096 wrote to memory of 1512	1096	ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe	ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe
PID 1096 wrote to memory of 1512	1096	ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe	ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe
PID 1096 wrote to memory of 1512	1096	ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe	ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe
PID 1096 wrote to memory of 1512	1096	ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe	ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe
PID 1096 wrote to memory of 1512	1096	ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe	ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe
PID 1096 wrote to memory of 1512	1096	ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe	ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe
PID 1096 wrote to memory of 1512	1096	ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe	ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe
PID 1096 wrote to memory of 1512	1096	ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe	ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe
PID 1096 wrote to memory of 1512	1096	ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe	ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe
PID 1096 wrote to memory of 1512	1096	ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe	ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe

C:\Users\Admin\AppData\Local\Temp\ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe
"C:\Users\Admin\AppData\Local\Temp\ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1096

C:\Users\Admin\AppData\Local\Temp\ff79cbf5a08feb95bf2194dadfa32dc911fc787c37afb1559724412cabd07de1.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:1512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1512-132-0x0000000000000000-mapping.dmp

Download
memory/1512-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1512-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1512-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1512-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1512-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download