d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d

Analysis

max time kernel
148s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 11:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe
Size

1.3MB
MD5

5ec093ab8837d4c4279dc649722c11bf
SHA1

cf2d378521f5d3c3049e7cc85ebcf6e41a1a6468
SHA256

d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d
SHA512

c75bfaef163eb72e9baac9b54b5900c650d4fbb685e9ff5ef48df59aa9767bd3af227ca05853973da01bc2dca433371fbae0d4242197a42cb1abfb0f047bdc94
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak:zrKo4ZwCOnYjVmJPa

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe

description	pid	process	target process
PID 872 set thread context of 4508	872	d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe	d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe

pid	process
4508	d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe
4508	d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe
4508	d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe
4508	d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe
4508	d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe

description	pid	process	target process
PID 872 wrote to memory of 4508	872	d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe	d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe
PID 872 wrote to memory of 4508	872	d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe	d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe
PID 872 wrote to memory of 4508	872	d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe	d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe
PID 872 wrote to memory of 4508	872	d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe	d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe
PID 872 wrote to memory of 4508	872	d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe	d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe
PID 872 wrote to memory of 4508	872	d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe	d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe
PID 872 wrote to memory of 4508	872	d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe	d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe
PID 872 wrote to memory of 4508	872	d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe	d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe
PID 872 wrote to memory of 4508	872	d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe	d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe
PID 872 wrote to memory of 4508	872	d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe	d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe

C:\Users\Admin\AppData\Local\Temp\d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe
"C:\Users\Admin\AppData\Local\Temp\d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:872

C:\Users\Admin\AppData\Local\Temp\d6f5829ff70d996961d34b56dbb6def1cf4c040f6b1f70ded3c61b8bc1567f5d.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4508-132-0x0000000000000000-mapping.dmp

Download
memory/4508-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4508-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4508-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4508-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4508-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download