fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042

Analysis

max time kernel
345s
max time network
415s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 08:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe
Size

1.3MB
MD5

67cb21175537e6478cd3a216247e6b9e
SHA1

09167a045818678d09061275fe879a371a335ffc
SHA256

fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042
SHA512

db01e0a91703ff2a17a48ae12981863c6fa3494559ca0d4bb3190b448acbf2acfd1968cf3ee807d5a0711edad8f41184967a976fed168b10b86e75a8b6ca79a0
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakH:7rKo4ZwCOnYjVmJPaY

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe

description	pid	process	target process
PID 1496 set thread context of 3388	1496	fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe	fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe

pid	process
3388	fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe
3388	fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe
3388	fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe
3388	fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe
3388	fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe

description	pid	process	target process
PID 1496 wrote to memory of 3388	1496	fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe	fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe
PID 1496 wrote to memory of 3388	1496	fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe	fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe
PID 1496 wrote to memory of 3388	1496	fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe	fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe
PID 1496 wrote to memory of 3388	1496	fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe	fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe
PID 1496 wrote to memory of 3388	1496	fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe	fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe
PID 1496 wrote to memory of 3388	1496	fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe	fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe
PID 1496 wrote to memory of 3388	1496	fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe	fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe
PID 1496 wrote to memory of 3388	1496	fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe	fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe
PID 1496 wrote to memory of 3388	1496	fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe	fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe
PID 1496 wrote to memory of 3388	1496	fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe	fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe

C:\Users\Admin\AppData\Local\Temp\fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe
"C:\Users\Admin\AppData\Local\Temp\fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1496

C:\Users\Admin\AppData\Local\Temp\fe39b792914dfc5e0bcbe44bce9987d7149167e7eac60ff9da599c8e473d5042.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:3388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3388-132-0x0000000000000000-mapping.dmp

Download
memory/3388-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3388-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3388-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3388-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3388-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3388-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download