7478b37f8af3e1b3660689350b1c9ebd49b6ed7816fe49603922bcefe439eabd

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 10:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

669628e60d64832594aa25497ccaa11a.exe
Size

399KB
MD5

669628e60d64832594aa25497ccaa11a
SHA1

a8e0bcbe94ac589b7b6cc3d34151db1087642060
SHA256

7478b37f8af3e1b3660689350b1c9ebd49b6ed7816fe49603922bcefe439eabd
SHA512

efc498668e83836272c7928fa2e63c38d4475cf0b6e1c5375e80cde13fce69963916a69c1249dc120ae14851982988ee108999922e4f1c06855bcb8d30a5643e
SSDEEP

3072:WJMp+hrboUmwr9iRmpRB5byIKqpY3SR4aMP5E0oXFbLmz3MqclI9GZbFoE0:WJMpdUmwJBp0y4aMPxoVHmwqbGZbFk

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 1856 set thread context of 4928	1856	669628e60d64832594aa25497ccaa11a.exe	88
PID 1856 set thread context of 0	1856	669628e60d64832594aa25497ccaa11a.exe
PID 1856 set thread context of 0	1856	669628e60d64832594aa25497ccaa11a.exe
PID 1856 set thread context of 0	1856	669628e60d64832594aa25497ccaa11a.exe
PID 1856 set thread context of 0	1856	669628e60d64832594aa25497ccaa11a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1856	669628e60d64832594aa25497ccaa11a.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 4928	1856	669628e60d64832594aa25497ccaa11a.exe	88
PID 1856 wrote to memory of 4928	1856	669628e60d64832594aa25497ccaa11a.exe	88
PID 1856 wrote to memory of 4928	1856	669628e60d64832594aa25497ccaa11a.exe	88
PID 1856 wrote to memory of 4928	1856	669628e60d64832594aa25497ccaa11a.exe	88
PID 1856 wrote to memory of 4928	1856	669628e60d64832594aa25497ccaa11a.exe	88
PID 1856 wrote to memory of 4928	1856	669628e60d64832594aa25497ccaa11a.exe	88
PID 1856 wrote to memory of 4928	1856	669628e60d64832594aa25497ccaa11a.exe	88
PID 1856 wrote to memory of 0	1856	669628e60d64832594aa25497ccaa11a.exe
PID 1856 wrote to memory of 0	1856	669628e60d64832594aa25497ccaa11a.exe
PID 1856 wrote to memory of 0	1856	669628e60d64832594aa25497ccaa11a.exe
PID 1856 wrote to memory of 0	1856	669628e60d64832594aa25497ccaa11a.exe
PID 1856 wrote to memory of 0	1856	669628e60d64832594aa25497ccaa11a.exe
PID 1856 wrote to memory of 0	1856	669628e60d64832594aa25497ccaa11a.exe
PID 1856 wrote to memory of 0	1856	669628e60d64832594aa25497ccaa11a.exe
PID 1856 wrote to memory of 0	1856	669628e60d64832594aa25497ccaa11a.exe
PID 1856 wrote to memory of 0	1856	669628e60d64832594aa25497ccaa11a.exe
PID 1856 wrote to memory of 0	1856	669628e60d64832594aa25497ccaa11a.exe
PID 1856 wrote to memory of 0	1856	669628e60d64832594aa25497ccaa11a.exe
PID 1856 wrote to memory of 0	1856	669628e60d64832594aa25497ccaa11a.exe
PID 1856 wrote to memory of 0	1856	669628e60d64832594aa25497ccaa11a.exe
PID 1856 wrote to memory of 0	1856	669628e60d64832594aa25497ccaa11a.exe
PID 1856 wrote to memory of 0	1856	669628e60d64832594aa25497ccaa11a.exe
PID 1856 wrote to memory of 0	1856	669628e60d64832594aa25497ccaa11a.exe

C:\Users\Admin\AppData\Local\Temp\669628e60d64832594aa25497ccaa11a.exe
"C:\Users\Admin\AppData\Local\Temp\669628e60d64832594aa25497ccaa11a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Users\Admin\AppData\Local\Temp\669628e60d64832594aa25497ccaa11a.exe
  "C:\Users\Admin\AppData\Local\Temp\669628e60d64832594aa25497ccaa11a.exe"
  2⤵
  PID:4928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1856-0-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1856-7-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/4928-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4928-5-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/4928-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4928-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4928-9-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/4928-10-0x0000000000410000-0x00000000004D9000-memory.dmp

Filesize
804KB

Download
memory/4928-11-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads