dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119

Analysis

max time kernel
201s
max time network
224s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe
Size

1.3MB
MD5

25c9339c89d2c2043e31e870b5c91cc8
SHA1

e3420b39756d6dd440daec9f4e637b7ddb7170f8
SHA256

dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119
SHA512

a9b01d9c3e9b0d670f7d6edaae981785f615f816771967ca7bac3fd5b5e486eec8e61e86415cd10d59f5ba807356645e85fb466d1e24385ef103574a1118b229
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakI:zrKo4ZwCOnYjVmJPa3

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe

description	pid	process	target process
PID 1080 set thread context of 612	1080	dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe	dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe

pid	process
612	dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe
612	dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe
612	dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe
612	dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe
612	dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe

description	pid	process	target process
PID 1080 wrote to memory of 612	1080	dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe	dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe
PID 1080 wrote to memory of 612	1080	dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe	dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe
PID 1080 wrote to memory of 612	1080	dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe	dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe
PID 1080 wrote to memory of 612	1080	dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe	dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe
PID 1080 wrote to memory of 612	1080	dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe	dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe
PID 1080 wrote to memory of 612	1080	dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe	dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe
PID 1080 wrote to memory of 612	1080	dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe	dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe
PID 1080 wrote to memory of 612	1080	dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe	dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe
PID 1080 wrote to memory of 612	1080	dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe	dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe
PID 1080 wrote to memory of 612	1080	dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe	dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe

C:\Users\Admin\AppData\Local\Temp\dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe
"C:\Users\Admin\AppData\Local\Temp\dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1080

C:\Users\Admin\AppData\Local\Temp\dd1c03cf90a38be21a58a994705385d41098b080f3cbc3317f336cc94a483119.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/612-132-0x0000000000000000-mapping.dmp

Download
memory/612-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/612-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/612-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/612-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/612-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download