9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96

Analysis

max time kernel
194s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 16:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe
Size

1.3MB
MD5

4163cc6f5cb4fcdfd4f19d61ba0a98d9
SHA1

84b0345d1f32032ee28444f00f6026a1c10d38aa
SHA256

9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96
SHA512

7495d06efa8984620b8cdeefca50398375d4d4c2c10afb899b3f1efee7e620e42dae5c6085d8a3344ce255ce3f8ca83d5d734661a8f8b443b1ce0023456041fb
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakc:zrKo4ZwCOnYjVmJPaz

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe

description	pid	process	target process
PID 2732 set thread context of 5000	2732	9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe	9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe

pid	process
5000	9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe
5000	9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe
5000	9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe
5000	9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe
5000	9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe

description	pid	process	target process
PID 2732 wrote to memory of 5000	2732	9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe	9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe
PID 2732 wrote to memory of 5000	2732	9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe	9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe
PID 2732 wrote to memory of 5000	2732	9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe	9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe
PID 2732 wrote to memory of 5000	2732	9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe	9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe
PID 2732 wrote to memory of 5000	2732	9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe	9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe
PID 2732 wrote to memory of 5000	2732	9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe	9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe
PID 2732 wrote to memory of 5000	2732	9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe	9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe
PID 2732 wrote to memory of 5000	2732	9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe	9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe
PID 2732 wrote to memory of 5000	2732	9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe	9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe
PID 2732 wrote to memory of 5000	2732	9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe	9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe

C:\Users\Admin\AppData\Local\Temp\9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe
"C:\Users\Admin\AppData\Local\Temp\9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2732

C:\Users\Admin\AppData\Local\Temp\9ddcd8ef9df764a42fab83344ce3bb4d998d93550cd3d7b3afa0832b62635e96.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:5000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5000-132-0x0000000000000000-mapping.dmp

Download
memory/5000-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/5000-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/5000-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/5000-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/5000-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/5000-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download