d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c

Analysis

max time kernel
161s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 12:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe
Size

1.3MB
MD5

8340b417bdcc72bb63ce34161902b590
SHA1

b00b101abbd9e9527eb35c25da9e4c3cbdd7b50b
SHA256

d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c
SHA512

74c41353fd2db27b95da97e1bd496cd88785c3112e9ae9a92cf78ba128b0625fc095aeb33710b725311a2ef8f0acbf7bc87e33cea4d56fdf8b60ce69451127c9
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakn:zrKo4ZwCOnYjVmJPaw

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe

description	pid	process	target process
PID 3160 set thread context of 4948	3160	d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe	d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe

pid	process
4948	d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe
4948	d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe
4948	d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe
4948	d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe
4948	d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe

description	pid	process	target process
PID 3160 wrote to memory of 4948	3160	d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe	d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe
PID 3160 wrote to memory of 4948	3160	d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe	d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe
PID 3160 wrote to memory of 4948	3160	d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe	d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe
PID 3160 wrote to memory of 4948	3160	d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe	d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe
PID 3160 wrote to memory of 4948	3160	d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe	d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe
PID 3160 wrote to memory of 4948	3160	d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe	d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe
PID 3160 wrote to memory of 4948	3160	d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe	d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe
PID 3160 wrote to memory of 4948	3160	d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe	d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe
PID 3160 wrote to memory of 4948	3160	d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe	d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe
PID 3160 wrote to memory of 4948	3160	d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe	d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe

C:\Users\Admin\AppData\Local\Temp\d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe
"C:\Users\Admin\AppData\Local\Temp\d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3160

C:\Users\Admin\AppData\Local\Temp\d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4948-132-0x0000000000000000-mapping.dmp

Download
memory/4948-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4948-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4948-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4948-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4948-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4948-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download