82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7

Analysis

max time kernel
184s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe
Size

1.3MB
MD5

4fc8be0d75b61651934109abdf88f025
SHA1

a4db1dc3a0c271f9239dfcc79efa860a4e9825ac
SHA256

82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7
SHA512

464474914344e88545d77a80afc4c25308a15139cd5ca07daaa3c23b6bf114b8129231ee37684d0ca6919a618ed2b3ff4321f04330caafdf7871c39060777031
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak2Q:7rKo4ZwCOnYjVmJPaHQ

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe

description	pid	process	target process
PID 1216 set thread context of 4148	1216	82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe	82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe

pid	process
4148	82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe
4148	82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe
4148	82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe
4148	82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe
4148	82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe

description	pid	process	target process
PID 1216 wrote to memory of 4148	1216	82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe	82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe
PID 1216 wrote to memory of 4148	1216	82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe	82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe
PID 1216 wrote to memory of 4148	1216	82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe	82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe
PID 1216 wrote to memory of 4148	1216	82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe	82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe
PID 1216 wrote to memory of 4148	1216	82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe	82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe
PID 1216 wrote to memory of 4148	1216	82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe	82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe
PID 1216 wrote to memory of 4148	1216	82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe	82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe
PID 1216 wrote to memory of 4148	1216	82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe	82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe
PID 1216 wrote to memory of 4148	1216	82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe	82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe
PID 1216 wrote to memory of 4148	1216	82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe	82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe

C:\Users\Admin\AppData\Local\Temp\82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe
"C:\Users\Admin\AppData\Local\Temp\82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1216

C:\Users\Admin\AppData\Local\Temp\82cba8eda46342038e5054a04b765026a42d1243280607d8a57668c6003bf7a7.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4148-132-0x0000000000000000-mapping.dmp

Download
memory/4148-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4148-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4148-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4148-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4148-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4148-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download