ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1

Analysis

max time kernel
284s
max time network
317s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe
Size

1.3MB
MD5

306cffd1649f99bbaa2becc5e9a97b9b
SHA1

96cd47e943ace6cb34758ec38018a92d4d9a8f3c
SHA256

ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1
SHA512

129b067eeb2aa5ab6361c1410dde96dec94845785cc90a05d9e762722e7f541fadc9a2ccd87d48eccb076b87799e31f1b7c5d48dcc06e85f49e8db5aa762f98d
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak0:zrKo4ZwCOnYjVmJPaT

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe

description	pid	process	target process
PID 4644 set thread context of 1464	4644	ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe	ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe

pid	process
1464	ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe
1464	ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe
1464	ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe
1464	ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe
1464	ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe

description	pid	process	target process
PID 4644 wrote to memory of 1464	4644	ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe	ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe
PID 4644 wrote to memory of 1464	4644	ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe	ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe
PID 4644 wrote to memory of 1464	4644	ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe	ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe
PID 4644 wrote to memory of 1464	4644	ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe	ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe
PID 4644 wrote to memory of 1464	4644	ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe	ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe
PID 4644 wrote to memory of 1464	4644	ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe	ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe
PID 4644 wrote to memory of 1464	4644	ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe	ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe
PID 4644 wrote to memory of 1464	4644	ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe	ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe
PID 4644 wrote to memory of 1464	4644	ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe	ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe
PID 4644 wrote to memory of 1464	4644	ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe	ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe

C:\Users\Admin\AppData\Local\Temp\ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe
"C:\Users\Admin\AppData\Local\Temp\ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4644

C:\Users\Admin\AppData\Local\Temp\ccdaf328b6e4876470d21c2eefff52461359e9355fb381e673d8f75e8770cfe1.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:1464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1464-132-0x0000000000000000-mapping.dmp

Download
memory/1464-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1464-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1464-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1464-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download