d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7

Analysis

max time kernel
256s
max time network
327s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 11:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe
Size

1.3MB
MD5

595ad8ac02f27429452853939df55355
SHA1

63f496090591b691ed86321cc50aad36db6b1214
SHA256

d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7
SHA512

3df3277d672cb3a9047905be4d03ba763547a1383413cf08bea8f6676e7d04e1f5e5dfcbdf433fbb4cc75d52376b73c1ae39cd6d31eeaf301266563ad5c9c28f
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakF:7rKo4ZwCOnYjVmJPaK

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe

description	pid	process	target process
PID 4016 set thread context of 3840	4016	d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe	d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe

pid	process
3840	d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe
3840	d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe
3840	d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe
3840	d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe
3840	d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe

description	pid	process	target process
PID 4016 wrote to memory of 3840	4016	d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe	d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe
PID 4016 wrote to memory of 3840	4016	d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe	d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe
PID 4016 wrote to memory of 3840	4016	d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe	d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe
PID 4016 wrote to memory of 3840	4016	d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe	d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe
PID 4016 wrote to memory of 3840	4016	d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe	d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe
PID 4016 wrote to memory of 3840	4016	d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe	d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe
PID 4016 wrote to memory of 3840	4016	d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe	d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe
PID 4016 wrote to memory of 3840	4016	d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe	d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe
PID 4016 wrote to memory of 3840	4016	d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe	d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe
PID 4016 wrote to memory of 3840	4016	d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe	d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe

C:\Users\Admin\AppData\Local\Temp\d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe
"C:\Users\Admin\AppData\Local\Temp\d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4016

C:\Users\Admin\AppData\Local\Temp\d5bddbee5dde60f2e25e66c5375031be4881616a8d1ad5a303df503d5b5d47a7.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:3840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3840-132-0x0000000000000000-mapping.dmp

Download
memory/3840-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3840-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3840-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3840-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3840-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download