813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61

Analysis

max time kernel
190s
max time network
232s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe
Size

1.3MB
MD5

ca8c72fc233c250b9f88e3168a658725
SHA1

dd3e98cc943a585134def849acbc199ed31e269b
SHA256

813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61
SHA512

af5df6a0cd7b25771acdfcd997874fb04fb1be13567d71cecc2fc2bf631f44f05d58dce55a58af7326db2bc07c2a83161f0fdd1c747f8045080a60da75547aee
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakr:TrKo4ZwCOnYjVmJPaI

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe

description	pid	process	target process
PID 4724 set thread context of 1644	4724	813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe	813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe

pid	process
1644	813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe
1644	813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe
1644	813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe
1644	813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe
1644	813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe

description	pid	process	target process
PID 4724 wrote to memory of 1644	4724	813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe	813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe
PID 4724 wrote to memory of 1644	4724	813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe	813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe
PID 4724 wrote to memory of 1644	4724	813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe	813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe
PID 4724 wrote to memory of 1644	4724	813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe	813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe
PID 4724 wrote to memory of 1644	4724	813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe	813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe
PID 4724 wrote to memory of 1644	4724	813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe	813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe
PID 4724 wrote to memory of 1644	4724	813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe	813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe
PID 4724 wrote to memory of 1644	4724	813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe	813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe
PID 4724 wrote to memory of 1644	4724	813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe	813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe
PID 4724 wrote to memory of 1644	4724	813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe	813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe

C:\Users\Admin\AppData\Local\Temp\813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe
"C:\Users\Admin\AppData\Local\Temp\813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Users\Admin\AppData\Local\Temp\813cd7a4fbee7d3e43588785c235ecc7695dadd6d8d7666786f40a386c619c61.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1644-132-0x0000000000000000-mapping.dmp

Download
memory/1644-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1644-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1644-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1644-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1644-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download