37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb

Analysis

max time kernel
180s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 01:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe
Size

1.3MB
MD5

787ea33d0efe93163e7a974779b214e1
SHA1

59a565684275e911a3615d6099bab8d060f453c3
SHA256

37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb
SHA512

14e227f33b4355a9f73ebb786020ea779767bcb822265c9f96aae1997c0a36ac8ce37676f3ba6c95d52a81d9e2eb9947fc02cb4d3d330e9c2f020861bc1c9f2e
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak/:zrKo4ZwCOnYjVmJPaw

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe

description	pid	process	target process
PID 4556 set thread context of 3456	4556	37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe	37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe

pid	process
3456	37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe
3456	37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe
3456	37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe
3456	37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe
3456	37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe

description	pid	process	target process
PID 4556 wrote to memory of 3456	4556	37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe	37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe
PID 4556 wrote to memory of 3456	4556	37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe	37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe
PID 4556 wrote to memory of 3456	4556	37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe	37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe
PID 4556 wrote to memory of 3456	4556	37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe	37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe
PID 4556 wrote to memory of 3456	4556	37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe	37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe
PID 4556 wrote to memory of 3456	4556	37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe	37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe
PID 4556 wrote to memory of 3456	4556	37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe	37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe
PID 4556 wrote to memory of 3456	4556	37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe	37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe
PID 4556 wrote to memory of 3456	4556	37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe	37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe
PID 4556 wrote to memory of 3456	4556	37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe	37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe

C:\Users\Admin\AppData\Local\Temp\37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe
"C:\Users\Admin\AppData\Local\Temp\37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4556

C:\Users\Admin\AppData\Local\Temp\37544c972587edd4862da5079042bc772bb7cd1ddc635319b6c60ee460cedcfb.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:3456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3456-132-0x0000000000000000-mapping.dmp

Download
memory/3456-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3456-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3456-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3456-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3456-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download