9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 16:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe
Size

1.3MB
MD5

1bdf93fbd85e9c2f1a9e11b20f577f7c
SHA1

d32852af927749d99d4503f008fb68230cdfd556
SHA256

9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24
SHA512

21c29e5e2391513482d7ecf5d70110c31956988cc53004d5d6a0e8917a91d98c362f102f0a489a5b47fcb0f56be5b85c0166c24837b8a6d20f09516f56093c8e
SSDEEP

24576:brKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakn:brKo4ZwCOnYjVmJPa4

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe

description	pid	process	target process
PID 644 set thread context of 2060	644	9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe	9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe

pid	process
2060	9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe
2060	9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe
2060	9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe
2060	9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe
2060	9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe

description	pid	process	target process
PID 644 wrote to memory of 2060	644	9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe	9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe
PID 644 wrote to memory of 2060	644	9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe	9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe
PID 644 wrote to memory of 2060	644	9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe	9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe
PID 644 wrote to memory of 2060	644	9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe	9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe
PID 644 wrote to memory of 2060	644	9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe	9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe
PID 644 wrote to memory of 2060	644	9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe	9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe
PID 644 wrote to memory of 2060	644	9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe	9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe
PID 644 wrote to memory of 2060	644	9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe	9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe
PID 644 wrote to memory of 2060	644	9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe	9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe
PID 644 wrote to memory of 2060	644	9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe	9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe

C:\Users\Admin\AppData\Local\Temp\9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe
"C:\Users\Admin\AppData\Local\Temp\9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:644

C:\Users\Admin\AppData\Local\Temp\9e64d5313e8ed0b30e837a07908a3636742717c688bb2dbf2de000fc3dc3bd24.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:2060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2060-132-0x0000000000000000-mapping.dmp

Download
memory/2060-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2060-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2060-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2060-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2060-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download