d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8

Analysis

max time kernel
131s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 11:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe
Size

1.3MB
MD5

d33cad07c0290bad9586acba0109ff9c
SHA1

6aade6e50d6f07b99ba5ed03ce129acf396b3fd3
SHA256

d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8
SHA512

1124e9961f77036707d1b69eca4d1b4134cf460e0071591a2fdb9fa6158712b274e2b36efc1293fdda576bbef270277af66225582322020fa813799d8860ae2f
SSDEEP

24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakP:jrKo4ZwCOnYjVmJPas

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe

description	pid	process	target process
PID 4932 set thread context of 724	4932	d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe	d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe

pid	process
724	d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe
724	d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe
724	d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe
724	d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe
724	d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe

description	pid	process	target process
PID 4932 wrote to memory of 724	4932	d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe	d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe
PID 4932 wrote to memory of 724	4932	d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe	d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe
PID 4932 wrote to memory of 724	4932	d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe	d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe
PID 4932 wrote to memory of 724	4932	d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe	d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe
PID 4932 wrote to memory of 724	4932	d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe	d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe
PID 4932 wrote to memory of 724	4932	d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe	d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe
PID 4932 wrote to memory of 724	4932	d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe	d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe
PID 4932 wrote to memory of 724	4932	d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe	d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe
PID 4932 wrote to memory of 724	4932	d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe	d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe
PID 4932 wrote to memory of 724	4932	d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe	d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe

C:\Users\Admin\AppData\Local\Temp\d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe
"C:\Users\Admin\AppData\Local\Temp\d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4932

C:\Users\Admin\AppData\Local\Temp\d50908a0e636daff600a0b23a0be286ea112989735b12f95b79e523235e316d8.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/724-132-0x0000000000000000-mapping.dmp

Download
memory/724-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/724-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/724-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/724-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/724-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/724-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download