6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe
Size

1.3MB
MD5

3ece971a4fda8d38d5caf3684abb1b5d
SHA1

8ab46756b296334f24686e1f8d22c5f5520f5aa1
SHA256

6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce
SHA512

3a721817779c4c91a65feb3a84057c43ce7a8a8e2014d3b31ca4dfb3ae0f310c4465041283be9e363e08a78cbdd9cdbf3b461846d669671574f473332082836c
SSDEEP

24576:brKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakx:brKo4ZwCOnYjVmJPa2

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe

description	pid	process	target process
PID 5040 set thread context of 4980	5040	6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe	6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe

pid	process
4980	6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe
4980	6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe
4980	6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe
4980	6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe
4980	6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe

description	pid	process	target process
PID 5040 wrote to memory of 4980	5040	6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe	6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe
PID 5040 wrote to memory of 4980	5040	6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe	6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe
PID 5040 wrote to memory of 4980	5040	6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe	6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe
PID 5040 wrote to memory of 4980	5040	6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe	6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe
PID 5040 wrote to memory of 4980	5040	6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe	6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe
PID 5040 wrote to memory of 4980	5040	6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe	6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe
PID 5040 wrote to memory of 4980	5040	6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe	6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe
PID 5040 wrote to memory of 4980	5040	6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe	6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe
PID 5040 wrote to memory of 4980	5040	6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe	6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe
PID 5040 wrote to memory of 4980	5040	6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe	6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe

C:\Users\Admin\AppData\Local\Temp\6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe
"C:\Users\Admin\AppData\Local\Temp\6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5040

C:\Users\Admin\AppData\Local\Temp\6d777199f2fe6bc819571b83e6f8a82bc8a16cbae6e450591c119d5a7d536cce.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4980-132-0x0000000000000000-mapping.dmp

Download
memory/4980-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4980-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4980-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4980-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4980-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download