d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576

Analysis

max time kernel
152s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 11:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe
Size

1.3MB
MD5

0b1cec10889b05ec344781dc56b9f2b0
SHA1

18738cbcd22eaf0126115e668f6aaed69e57612c
SHA256

d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576
SHA512

f7ee325ef82de95c27b2688555161b875708088587c976bbdfabed772463b4fd760d22ffe8a821fec6fbec9db625c7fc22c003205f67ce8121a06226123bf669
SSDEEP

24576:brKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakQ:brKo4ZwCOnYjVmJPaf

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe

description	pid	process	target process
PID 1632 set thread context of 1520	1632	d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe	d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe

pid	process
1520	d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe
1520	d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe
1520	d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe
1520	d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe
1520	d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe

description	pid	process	target process
PID 1632 wrote to memory of 1520	1632	d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe	d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe
PID 1632 wrote to memory of 1520	1632	d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe	d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe
PID 1632 wrote to memory of 1520	1632	d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe	d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe
PID 1632 wrote to memory of 1520	1632	d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe	d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe
PID 1632 wrote to memory of 1520	1632	d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe	d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe
PID 1632 wrote to memory of 1520	1632	d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe	d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe
PID 1632 wrote to memory of 1520	1632	d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe	d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe
PID 1632 wrote to memory of 1520	1632	d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe	d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe
PID 1632 wrote to memory of 1520	1632	d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe	d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe
PID 1632 wrote to memory of 1520	1632	d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe	d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe

C:\Users\Admin\AppData\Local\Temp\d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe
"C:\Users\Admin\AppData\Local\Temp\d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1632

C:\Users\Admin\AppData\Local\Temp\d3d5b34bd0d30a3a75e70104475e364b0e86d944a86f0ab00c2b36b5f877e576.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:1520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1520-132-0x0000000000000000-mapping.dmp

Download
memory/1520-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1520-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1520-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1520-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1520-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1520-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download