6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241

Analysis

max time kernel
339s
max time network
412s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe
Size

1.3MB
MD5

4bd654347bb2a07b6c42fdee5f04ef70
SHA1

18f503b8b2a78e80ce37d2f7dcfd5d40053bda66
SHA256

6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241
SHA512

bb6e51bc24e9239cb4fbafe7e08229b10f61932076d512118dbfbeb63d65a20b15a85fcada00f240f10b78720dd26f821553f3150542af38125af186ae8c078e
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakj:zrKo4ZwCOnYjVmJPag

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe

description	pid	process	target process
PID 2608 set thread context of 4740	2608	6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe	6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe

pid	process
4740	6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe
4740	6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe
4740	6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe
4740	6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe
4740	6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe

description	pid	process	target process
PID 2608 wrote to memory of 4740	2608	6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe	6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe
PID 2608 wrote to memory of 4740	2608	6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe	6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe
PID 2608 wrote to memory of 4740	2608	6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe	6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe
PID 2608 wrote to memory of 4740	2608	6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe	6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe
PID 2608 wrote to memory of 4740	2608	6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe	6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe
PID 2608 wrote to memory of 4740	2608	6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe	6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe
PID 2608 wrote to memory of 4740	2608	6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe	6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe
PID 2608 wrote to memory of 4740	2608	6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe	6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe
PID 2608 wrote to memory of 4740	2608	6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe	6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe
PID 2608 wrote to memory of 4740	2608	6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe	6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe

C:\Users\Admin\AppData\Local\Temp\6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe
"C:\Users\Admin\AppData\Local\Temp\6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2608

C:\Users\Admin\AppData\Local\Temp\6d7afb16439ae2edb4bb79ed616f0241712c9befb8717b03e33555fc92c3f241.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4740-132-0x0000000000000000-mapping.dmp

Download
memory/4740-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4740-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4740-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4740-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4740-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download