37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542

Analysis

max time kernel
142s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 01:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe
Size

1.3MB
MD5

70647f61ba1af4c62ee13ae09c9a1e42
SHA1

e35dff36f255ca3280e3b7097c4474c042b36650
SHA256

37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542
SHA512

3a0c5a74713a5ef6c5b049e6f09cbd922c7e934ef0f55c479e6d99e0a1738a7c77be8f3901516a9387fce85de97f2258921249e6339ef684e3d2e84b2a88f71a
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakR:7rKo4ZwCOnYjVmJPa2

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe

description	pid	process	target process
PID 5112 set thread context of 1648	5112	37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe	37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe

pid	process
1648	37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe
1648	37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe
1648	37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe
1648	37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe
1648	37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe

description	pid	process	target process
PID 5112 wrote to memory of 1648	5112	37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe	37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe
PID 5112 wrote to memory of 1648	5112	37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe	37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe
PID 5112 wrote to memory of 1648	5112	37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe	37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe
PID 5112 wrote to memory of 1648	5112	37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe	37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe
PID 5112 wrote to memory of 1648	5112	37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe	37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe
PID 5112 wrote to memory of 1648	5112	37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe	37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe
PID 5112 wrote to memory of 1648	5112	37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe	37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe
PID 5112 wrote to memory of 1648	5112	37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe	37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe
PID 5112 wrote to memory of 1648	5112	37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe	37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe
PID 5112 wrote to memory of 1648	5112	37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe	37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe

C:\Users\Admin\AppData\Local\Temp\37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe
"C:\Users\Admin\AppData\Local\Temp\37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5112

C:\Users\Admin\AppData\Local\Temp\37fb4e3294ae52930c388342e4740c457bcce9b140bde740f88bc2fbd80d9542.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:1648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-132-0x0000000000000000-mapping.dmp

Download
memory/1648-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1648-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1648-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1648-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1648-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download