Analysis

  • max time kernel
    146s
  • max time network
    181s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2022, 21:46

General

  • Target

    93508d80f6048497e79e271dd5d23dbb79855e9c9c7585c6b7927ac5577583e3.exe

  • Size

    1.3MB

  • MD5

    b1566236181643e36c39cd765bbef6fc

  • SHA1

    6ad651ac984afdb759e37d1895a5bcbe2b856078

  • SHA256

    93508d80f6048497e79e271dd5d23dbb79855e9c9c7585c6b7927ac5577583e3

  • SHA512

    ceb6608c8946fe1157240743d04aac4fc3659959c559b910d7430029f6174d3f6980ce45ab3d2cc9515e2c8b169c221cdfe3ec60ed7b06a7b37297b9da12f811

  • SSDEEP

    24576:8etyVM24XFiG1OE3gsbqCKAu+QzbIEJ/PXphheyMSlNzGtV:vf71R1fw6/u+7MP15+tV

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\93508d80f6048497e79e271dd5d23dbb79855e9c9c7585c6b7927ac5577583e3.exe
    "C:\Users\Admin\AppData\Local\Temp\93508d80f6048497e79e271dd5d23dbb79855e9c9c7585c6b7927ac5577583e3.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:220
    • C:\Users\Admin\AppData\Local\Temp\93508d80f6048497e79e271dd5d23dbb79855e9c9c7585c6b7927ac5577583e3.exe
      "C:\Users\Admin\AppData\Local\Temp\93508d80f6048497e79e271dd5d23dbb79855e9c9c7585c6b7927ac5577583e3.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:1804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/220-132-0x0000000002320000-0x0000000002325000-memory.dmp

    Filesize

    20KB

  • memory/1804-136-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/1804-137-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB