dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177

Analysis

max time kernel
141s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe
Size

1.3MB
MD5

cf3216c66b829c246781dcb0d5aded34
SHA1

ed62fdfd3611645651e3326e9275437a0d792862
SHA256

dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177
SHA512

428440b1f4aebba0a5392d89463c7ec34bb1394a31a08629824628472a297ef93858b183f60525e99aac8b2c413dae001d85dbf0d2f7b0806fec65694627b82b
SSDEEP

24576:DrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakj:DrKo4ZwCOnYjVmJPao

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe

description	pid	process	target process
PID 2656 set thread context of 4320	2656	dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe	dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe

pid	process
4320	dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe
4320	dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe
4320	dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe
4320	dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe
4320	dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe

description	pid	process	target process
PID 2656 wrote to memory of 4320	2656	dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe	dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe
PID 2656 wrote to memory of 4320	2656	dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe	dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe
PID 2656 wrote to memory of 4320	2656	dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe	dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe
PID 2656 wrote to memory of 4320	2656	dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe	dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe
PID 2656 wrote to memory of 4320	2656	dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe	dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe
PID 2656 wrote to memory of 4320	2656	dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe	dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe
PID 2656 wrote to memory of 4320	2656	dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe	dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe
PID 2656 wrote to memory of 4320	2656	dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe	dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe
PID 2656 wrote to memory of 4320	2656	dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe	dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe
PID 2656 wrote to memory of 4320	2656	dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe	dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe

C:\Users\Admin\AppData\Local\Temp\dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe
"C:\Users\Admin\AppData\Local\Temp\dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2656

C:\Users\Admin\AppData\Local\Temp\dc7c94946c027c62f8fdfb0e8f7f699733f9eb3b8566f6aaade74c038860f177.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4320-132-0x0000000000000000-mapping.dmp

Download
memory/4320-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4320-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4320-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4320-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4320-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download