b2989e35351b59cd09af94f5c34a219c62c3a9dadd916388e383b3cf1681784c | Triage

Analysis

max time kernel
152s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 22:52

Sharing

Report Analysis Logs

General

Target

ppi.exe
Size

364KB
MD5

c16a58796b7d10ea3e812e7e55c274ee
SHA1

ea985f6d2ac90fd652f298a3183166ce2b1a58e1
SHA256

04f804ae6a9bb208121454bc909a212b272c92adc1c1d24353e08320a3485646
SHA512

f51d5c33d3254bdc3d9b950c95f832a758c2ba4575ef474638f361dd740b84781cf3333130d3797e0fe4aa539a5bebe6f5e7032c99d5cd12fa555f80047c2f65
SSDEEP

6144:RqxjFV8M94cGTy5SPakDDQjqlFMURWxrSzZmz4:A74bAwVMMjmz

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3084 set thread context of 1716	3084	ppi.exe	81

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3084	ppi.exe
1716	ppi.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 1716	3084	ppi.exe	81
PID 3084 wrote to memory of 1716	3084	ppi.exe	81
PID 3084 wrote to memory of 1716	3084	ppi.exe	81
PID 3084 wrote to memory of 1716	3084	ppi.exe	81
PID 3084 wrote to memory of 1716	3084	ppi.exe	81
PID 3084 wrote to memory of 1716	3084	ppi.exe	81
PID 3084 wrote to memory of 1716	3084	ppi.exe	81
PID 3084 wrote to memory of 1716	3084	ppi.exe	81

C:\Users\Admin\AppData\Local\Temp\ppi.exe
"C:\Users\Admin\AppData\Local\Temp\ppi.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Users\Admin\AppData\Local\Temp\ppi.exe
  "C:\Users\Admin\AppData\Local\Temp\ppi.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1716-135-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1716-139-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1716-140-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download