daa8802270996f3d7b4835fd9fba42da054ad1a58403854c0f86b0666c631ac1 | Triage

Analysis

max time kernel
91s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 11:26

Sharing

Report Analysis Logs

General

Target

102.exe
Size

296KB
MD5

53dbea2d9cbdaa8271d05eb5dbb26cd6
SHA1

e991722d8f9d739f8a3adaf70cd8c3c905ce995f
SHA256

810d0d8097c08297f9ddbba9d513ea75ec3cc50ca2f82c7985e148b191ad5a05
SHA512

617c7df31822baf436c88b3d5698b573fcc49f20332b209d134caee682620520fd91b55f671ddfbb857eae212bcf10dfd93438cd648477d43f9cbbe9fcc41fa1
SSDEEP

6144:uVI/y3qx3YgnXIqE8LsUCSLdgR4XbMg65AGdU:hKaxYgYqEssdSGyrMBQ

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4560 set thread context of 3280	4560	102.exe	80

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4560	102.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 3280	4560	102.exe	80
PID 4560 wrote to memory of 3280	4560	102.exe	80
PID 4560 wrote to memory of 3280	4560	102.exe	80
PID 4560 wrote to memory of 3280	4560	102.exe	80
PID 4560 wrote to memory of 3280	4560	102.exe	80
PID 4560 wrote to memory of 3280	4560	102.exe	80
PID 4560 wrote to memory of 3280	4560	102.exe	80
PID 4560 wrote to memory of 3280	4560	102.exe	80

C:\Users\Admin\AppData\Local\Temp\102.exe
"C:\Users\Admin\AppData\Local\Temp\102.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Users\Admin\AppData\Local\Temp\102.exe
  "C:\Users\Admin\AppData\Local\Temp\102.exe"
  2⤵
  PID:3280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3280-136-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3280-139-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4560-134-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4560-138-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download