36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731

Analysis

max time kernel
152s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 02:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe
Size

1.3MB
MD5

9ead035e253a968b691fa5ebcb3351f7
SHA1

7c2d785df5daf6d985007ae650b0590ba74996c2
SHA256

36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731
SHA512

8096c797f7787619a5ead69a477825df1ee4e657423957af65e7f58633a9b524e891ebf0e6a87b9c7037a6f070922b23a28498d7294b5d200bcd950cd0577e26
SSDEEP

24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakm:jrKo4ZwCOnYjVmJPaJ

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe

description	pid	process	target process
PID 3032 set thread context of 876	3032	36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe	36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe

pid	process
876	36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe
876	36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe
876	36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe
876	36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe
876	36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe

description	pid	process	target process
PID 3032 wrote to memory of 876	3032	36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe	36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe
PID 3032 wrote to memory of 876	3032	36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe	36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe
PID 3032 wrote to memory of 876	3032	36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe	36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe
PID 3032 wrote to memory of 876	3032	36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe	36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe
PID 3032 wrote to memory of 876	3032	36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe	36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe
PID 3032 wrote to memory of 876	3032	36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe	36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe
PID 3032 wrote to memory of 876	3032	36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe	36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe
PID 3032 wrote to memory of 876	3032	36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe	36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe
PID 3032 wrote to memory of 876	3032	36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe	36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe
PID 3032 wrote to memory of 876	3032	36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe	36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe

C:\Users\Admin\AppData\Local\Temp\36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe
"C:\Users\Admin\AppData\Local\Temp\36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3032

C:\Users\Admin\AppData\Local\Temp\36c56eaf74833007ebe067da7c4cf06f7697c16b5e94d41e3fc85e107ebbd731.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/876-133-0x0000000000000000-mapping.dmp

Download
memory/876-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/876-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/876-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/876-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/876-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download