cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe
Size

1.3MB
MD5

3ea389711de1901e0cef3dc543d9a87a
SHA1

a6bf9a247334fdd384277edabd59bb72b86f62a1
SHA256

cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2
SHA512

2104a8ddb42551205f72d41a53dabf57169a341ab33a9aeef6c0779d844d372be5a38427452a1e959953426bfacc0a45bb56377b1fa60eb261d779631b5101f7
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak4:zrKo4ZwCOnYjVmJPaL

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe

description	pid	process	target process
PID 1528 set thread context of 4660	1528	cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe	cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe

pid	process
4660	cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe
4660	cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe
4660	cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe
4660	cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe
4660	cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe

description	pid	process	target process
PID 1528 wrote to memory of 4660	1528	cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe	cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe
PID 1528 wrote to memory of 4660	1528	cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe	cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe
PID 1528 wrote to memory of 4660	1528	cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe	cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe
PID 1528 wrote to memory of 4660	1528	cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe	cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe
PID 1528 wrote to memory of 4660	1528	cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe	cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe
PID 1528 wrote to memory of 4660	1528	cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe	cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe
PID 1528 wrote to memory of 4660	1528	cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe	cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe
PID 1528 wrote to memory of 4660	1528	cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe	cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe
PID 1528 wrote to memory of 4660	1528	cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe	cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe
PID 1528 wrote to memory of 4660	1528	cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe	cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe

C:\Users\Admin\AppData\Local\Temp\cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe
"C:\Users\Admin\AppData\Local\Temp\cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1528

C:\Users\Admin\AppData\Local\Temp\cc54eea854cc4f3ab39fe306bb9b7d2a26dc5ef06e8415b51cd1d452bcf7f6e2.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4660-132-0x0000000000000000-mapping.dmp

Download
memory/4660-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4660-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4660-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4660-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4660-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download