5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f

Analysis

max time kernel
304s
max time network
390s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe
Size

1.3MB
MD5

9bbb5366fa76dcece570a548b49d5f09
SHA1

1b3b3a7908135f05bc517159b9957f994325ff91
SHA256

5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f
SHA512

0ffec5e6b0e5a0d904b8e7a0773939cd8d666554a7a9c45809abe33e64fbb9c99ec6882839a1caccfeddb0c86b23e0d1c2a0d4da6a15d251e10d28613da32902
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakV:zrKo4ZwCOnYjVmJPaS

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe

description	pid	process	target process
PID 3972 set thread context of 3408	3972	5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe	5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe

pid	process
3408	5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe
3408	5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe
3408	5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe
3408	5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe
3408	5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe

description	pid	process	target process
PID 3972 wrote to memory of 3408	3972	5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe	5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe
PID 3972 wrote to memory of 3408	3972	5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe	5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe
PID 3972 wrote to memory of 3408	3972	5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe	5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe
PID 3972 wrote to memory of 3408	3972	5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe	5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe
PID 3972 wrote to memory of 3408	3972	5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe	5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe
PID 3972 wrote to memory of 3408	3972	5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe	5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe
PID 3972 wrote to memory of 3408	3972	5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe	5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe
PID 3972 wrote to memory of 3408	3972	5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe	5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe
PID 3972 wrote to memory of 3408	3972	5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe	5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe
PID 3972 wrote to memory of 3408	3972	5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe	5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe

C:\Users\Admin\AppData\Local\Temp\5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe
"C:\Users\Admin\AppData\Local\Temp\5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3972

C:\Users\Admin\AppData\Local\Temp\5c8476dc6ee8fbb6ad371d162caf2ce7a34a144f0d84c431d3eb5fb3c2dae82f.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:3408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3408-133-0x0000000000000000-mapping.dmp

Download
memory/3408-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3408-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3408-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3408-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download