c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667

Analysis

max time kernel
202s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe
Size

1.3MB
MD5

081bec6e3cf918ad92ac0b1070b93ab0
SHA1

503a3ba1b999d2852a9a0f0c3b945fa47754b434
SHA256

c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667
SHA512

61958d45c4dfeff277688fa7c00e46da4de79b9fb5d30aa5a76de374c12ca5833dcd85f8aeb8bbec6960f46373d76c132853a94359464b3c20b91859435e175e
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak1:zrKo4ZwCOnYjVmJPaa

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe

description	pid	process	target process
PID 3620 set thread context of 320	3620	c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe	c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe

pid	process
320	c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe
320	c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe
320	c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe
320	c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe
320	c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe

description	pid	process	target process
PID 3620 wrote to memory of 320	3620	c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe	c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe
PID 3620 wrote to memory of 320	3620	c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe	c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe
PID 3620 wrote to memory of 320	3620	c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe	c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe
PID 3620 wrote to memory of 320	3620	c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe	c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe
PID 3620 wrote to memory of 320	3620	c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe	c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe
PID 3620 wrote to memory of 320	3620	c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe	c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe
PID 3620 wrote to memory of 320	3620	c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe	c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe
PID 3620 wrote to memory of 320	3620	c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe	c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe
PID 3620 wrote to memory of 320	3620	c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe	c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe
PID 3620 wrote to memory of 320	3620	c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe	c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe

C:\Users\Admin\AppData\Local\Temp\c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe
"C:\Users\Admin\AppData\Local\Temp\c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3620

C:\Users\Admin\AppData\Local\Temp\c55cb4a5557db834ce2045d465fcea3a276da1b02422dd2f3791e4ad9aa6d667.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/320-132-0x0000000000000000-mapping.dmp

Download
memory/320-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/320-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/320-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/320-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/320-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download