a0d580d15989c7a47a87d46fbdb41f2bda78bf30285702ee550517965fcc20db

Analysis

max time kernel
91s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 03:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0d580d15989c7a47a87d46fbdb41f2bda78bf30285702ee550517965fcc20db.exe
Size

49KB
MD5

02041bfe6ce45792bb36f0f8ec162ade
SHA1

562db523680cc9a0789a3247e3819d2c7486f601
SHA256

a0d580d15989c7a47a87d46fbdb41f2bda78bf30285702ee550517965fcc20db
SHA512

5e921b8a22f228b99c38e2ec693d6cb236062564ff50dc3368e45f805d07fcba4e5f6ac6ba52afbc593914c87a622ee24a0c80e17ed88931dd0aafb13e3cbd5d
SSDEEP

768:ypWbmvZHKZ6Elx9ZNRdYfqRfUBea9jYPtrR0l+xlg5qgQQfPhYkfRA:ypWiHKzhZNgvRgrRRkbdf3A

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5000 set thread context of 1180	5000	a0d580d15989c7a47a87d46fbdb41f2bda78bf30285702ee550517965fcc20db.exe	81
PID 1180 set thread context of 2008	1180	a0d580d15989c7a47a87d46fbdb41f2bda78bf30285702ee550517965fcc20db.exe	82

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 1180	5000	a0d580d15989c7a47a87d46fbdb41f2bda78bf30285702ee550517965fcc20db.exe	81
PID 5000 wrote to memory of 1180	5000	a0d580d15989c7a47a87d46fbdb41f2bda78bf30285702ee550517965fcc20db.exe	81
PID 5000 wrote to memory of 1180	5000	a0d580d15989c7a47a87d46fbdb41f2bda78bf30285702ee550517965fcc20db.exe	81
PID 5000 wrote to memory of 1180	5000	a0d580d15989c7a47a87d46fbdb41f2bda78bf30285702ee550517965fcc20db.exe	81
PID 5000 wrote to memory of 1180	5000	a0d580d15989c7a47a87d46fbdb41f2bda78bf30285702ee550517965fcc20db.exe	81
PID 5000 wrote to memory of 1180	5000	a0d580d15989c7a47a87d46fbdb41f2bda78bf30285702ee550517965fcc20db.exe	81
PID 5000 wrote to memory of 1180	5000	a0d580d15989c7a47a87d46fbdb41f2bda78bf30285702ee550517965fcc20db.exe	81
PID 5000 wrote to memory of 1180	5000	a0d580d15989c7a47a87d46fbdb41f2bda78bf30285702ee550517965fcc20db.exe	81
PID 1180 wrote to memory of 2008	1180	a0d580d15989c7a47a87d46fbdb41f2bda78bf30285702ee550517965fcc20db.exe	82
PID 1180 wrote to memory of 2008	1180	a0d580d15989c7a47a87d46fbdb41f2bda78bf30285702ee550517965fcc20db.exe	82
PID 1180 wrote to memory of 2008	1180	a0d580d15989c7a47a87d46fbdb41f2bda78bf30285702ee550517965fcc20db.exe	82
PID 1180 wrote to memory of 2008	1180	a0d580d15989c7a47a87d46fbdb41f2bda78bf30285702ee550517965fcc20db.exe	82
PID 1180 wrote to memory of 2008	1180	a0d580d15989c7a47a87d46fbdb41f2bda78bf30285702ee550517965fcc20db.exe	82
PID 1180 wrote to memory of 2008	1180	a0d580d15989c7a47a87d46fbdb41f2bda78bf30285702ee550517965fcc20db.exe	82

C:\Users\Admin\AppData\Local\Temp\a0d580d15989c7a47a87d46fbdb41f2bda78bf30285702ee550517965fcc20db.exe
"C:\Users\Admin\AppData\Local\Temp\a0d580d15989c7a47a87d46fbdb41f2bda78bf30285702ee550517965fcc20db.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Users\Admin\AppData\Local\Temp\a0d580d15989c7a47a87d46fbdb41f2bda78bf30285702ee550517965fcc20db.exe
  C:\Users\Admin\AppData\Local\Temp\a0d580d15989c7a47a87d46fbdb41f2bda78bf30285702ee550517965fcc20db.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Users\Admin\AppData\Local\Temp\a0d580d15989c7a47a87d46fbdb41f2bda78bf30285702ee550517965fcc20db.exe
    C:\Users\Admin\AppData\Local\Temp\a0d580d15989c7a47a87d46fbdb41f2bda78bf30285702ee550517965fcc20db.exe
    3⤵
    PID:2008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1180-133-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1180-135-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1180-138-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2008-137-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2008-140-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2008-141-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2008-142-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads