a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797

Analysis

max time kernel
190s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 16:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe
Size

1.6MB
MD5

a862fac3349e8af6b4e504a335e53581
SHA1

a9fbdb39d019b9fe99f81fbfe8d4dd883c9da134
SHA256

a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797
SHA512

765cf91e381814b3570a091e7d5b87d5b42faee66e2df1489f4d1700a2bc52d51639e06e3c75dd2fa0caaddd586a24313770500b0fa8e6768f9d1d98df3f4288
SSDEEP

24576:9zD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUYB:X6/ye0PIphrp9Zuvjqa0Uidm

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe

description	pid	process	target process
PID 2768 set thread context of 4964	2768	a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe	a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe

pid	process
4964	a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe
4964	a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe
4964	a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe
4964	a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe
4964	a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe

description	pid	process	target process
PID 2768 wrote to memory of 4964	2768	a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe	a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe
PID 2768 wrote to memory of 4964	2768	a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe	a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe
PID 2768 wrote to memory of 4964	2768	a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe	a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe
PID 2768 wrote to memory of 4964	2768	a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe	a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe
PID 2768 wrote to memory of 4964	2768	a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe	a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe
PID 2768 wrote to memory of 4964	2768	a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe	a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe
PID 2768 wrote to memory of 4964	2768	a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe	a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe
PID 2768 wrote to memory of 4964	2768	a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe	a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe
PID 2768 wrote to memory of 4964	2768	a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe	a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe
PID 2768 wrote to memory of 4964	2768	a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe	a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe

C:\Users\Admin\AppData\Local\Temp\a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe
"C:\Users\Admin\AppData\Local\Temp\a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2768

C:\Users\Admin\AppData\Local\Temp\a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe
"C:\Users\Admin\AppData\Local\Temp\a09224f84d2cc93a8d9463b07b9f765d58c634ebc4c11f9fa3578a74ef77a797.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:4964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4964-132-0x0000000000000000-mapping.dmp

Download
memory/4964-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4964-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4964-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4964-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4964-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download