3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922

Analysis

max time kernel
134s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe
Size

1.3MB
MD5

8696bb6aa13b05b5a8561d19d5ca7323
SHA1

b7c6df71e3d62f31a6d66e30f5c4ce09940898e2
SHA256

3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922
SHA512

7796ee3e547450d0ea49e93775dbd5a14a7c7a271a772003d75272cedb8ea047fe1b936ddfded4ff5756cd6a6530cf92ac5a02f2e060c8ac225a1696ac4c0525
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakn:zrKo4ZwCOnYjVmJPa8

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe

description	pid	process	target process
PID 4060 set thread context of 1436	4060	3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe	3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe

pid	process
1436	3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe
1436	3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe
1436	3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe
1436	3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe
1436	3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe

description	pid	process	target process
PID 4060 wrote to memory of 1436	4060	3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe	3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe
PID 4060 wrote to memory of 1436	4060	3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe	3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe
PID 4060 wrote to memory of 1436	4060	3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe	3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe
PID 4060 wrote to memory of 1436	4060	3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe	3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe
PID 4060 wrote to memory of 1436	4060	3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe	3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe
PID 4060 wrote to memory of 1436	4060	3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe	3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe
PID 4060 wrote to memory of 1436	4060	3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe	3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe
PID 4060 wrote to memory of 1436	4060	3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe	3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe
PID 4060 wrote to memory of 1436	4060	3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe	3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe
PID 4060 wrote to memory of 1436	4060	3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe	3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe

C:\Users\Admin\AppData\Local\Temp\3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe
"C:\Users\Admin\AppData\Local\Temp\3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4060

C:\Users\Admin\AppData\Local\Temp\3be72929b007d43e2856039aba0be6f3da67650bff54a4a8ef1eea4c4cef9922.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:1436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1436-132-0x0000000000000000-mapping.dmp

Download
memory/1436-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1436-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1436-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1436-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1436-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download