3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68

General

Target

3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe
Size

254KB
MD5

9586025230f5639c55c060f361014223
SHA1

7fbe85d18ffa4eec4b296fc53794aeea1311cd80
SHA256

3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68
SHA512

9f800df2d95439a71f2fe9f0cd8ce04539f283c6c58c877a7a2ad2481d485543ffc2fa728ca432aa40acb382925341b07957e9f78d17a8d5a9b413bc846372ae

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe

description	pid	process	target process
PID 2728 set thread context of 3596	2728	3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe	3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe

C:\Users\Admin\AppData\Local\Temp\3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe
"C:\Users\Admin\AppData\Local\Temp\3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2728

C:\Users\Admin\AppData\Local\Temp\3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe
"{path}"
2⤵
- Suspicious use of WriteProcessMemory
PID:3596

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
3⤵
PID:3820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3596-0-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/3596-1-0x0000000000405907-mapping.dmp

Download
memory/3596-2-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/3820-3-0x0000000000000000-mapping.dmp

Download
memory/3820-4-0x0000000000000000-mapping.dmp

Download

description	pid	process	target process
PID 2728 wrote to memory of 3596	2728	3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe	3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe
PID 2728 wrote to memory of 3596	2728	3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe	3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe
PID 2728 wrote to memory of 3596	2728	3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe	3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe
PID 2728 wrote to memory of 3596	2728	3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe	3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe
PID 2728 wrote to memory of 3596	2728	3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe	3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe
PID 2728 wrote to memory of 3596	2728	3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe	3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe
PID 2728 wrote to memory of 3596	2728	3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe	3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe
PID 2728 wrote to memory of 3596	2728	3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe	3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe
PID 2728 wrote to memory of 3596	2728	3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe	3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe
PID 2728 wrote to memory of 3596	2728	3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe	3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe
PID 2728 wrote to memory of 3596	2728	3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe	3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe
PID 3596 wrote to memory of 3820	3596	3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe	cmd.exe
PID 3596 wrote to memory of 3820	3596	3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe	cmd.exe
PID 3596 wrote to memory of 3820	3596	3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe	cmd.exe
PID 3596 wrote to memory of 3820	3596	3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe	cmd.exe
PID 3596 wrote to memory of 3820	3596	3cc27abf2f572f865686fcdff03c0ecc3b12c71bfa890d3c23a09e42766dad68.exe	cmd.exe

Analysis

Sharing