a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70

Analysis

max time kernel
188s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 16:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe
Size

1.6MB
MD5

d381121b267f13551ee6efb5f03b9b89
SHA1

27e72683cbd5e1530a86a7abba58bb76c37744fd
SHA256

a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70
SHA512

c80318386525e942170b007008987b2ab400688b97bb42238aa783d2f941d4f8c3f91839cc4668349e4206a65a26c81a9e5a49b8d0d4022dfd546e0a215b7dc5
SSDEEP

24576:xzD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUYe:D6/ye0PIphrp9Zuvjqa0Uidl

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe

description	pid	process	target process
PID 4320 set thread context of 4412	4320	a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe	a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe

pid	process
4412	a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe
4412	a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe
4412	a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe
4412	a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe
4412	a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe

description	pid	process	target process
PID 4320 wrote to memory of 4412	4320	a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe	a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe
PID 4320 wrote to memory of 4412	4320	a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe	a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe
PID 4320 wrote to memory of 4412	4320	a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe	a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe
PID 4320 wrote to memory of 4412	4320	a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe	a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe
PID 4320 wrote to memory of 4412	4320	a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe	a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe
PID 4320 wrote to memory of 4412	4320	a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe	a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe
PID 4320 wrote to memory of 4412	4320	a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe	a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe
PID 4320 wrote to memory of 4412	4320	a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe	a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe
PID 4320 wrote to memory of 4412	4320	a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe	a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe
PID 4320 wrote to memory of 4412	4320	a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe	a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe

C:\Users\Admin\AppData\Local\Temp\a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe
"C:\Users\Admin\AppData\Local\Temp\a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4320

C:\Users\Admin\AppData\Local\Temp\a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe
"C:\Users\Admin\AppData\Local\Temp\a091818860db2a3b5f68159f84bf84c33abb1eacfa552d2cbab7c2841a277f70.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:4412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4412-132-0x0000000000000000-mapping.dmp

Download
memory/4412-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4412-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4412-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4412-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4412-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4412-138-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download