5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0

Analysis

max time kernel
169s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe
Size

1.1MB
MD5

8a20f2f8ecbb252afe37fcc7a0cea2be
SHA1

a391226548d5255d56d93c610ec9bda6aaf17341
SHA256

5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0
SHA512

771998d5998d5eea143ecb04ffa9fce89115fbaba9d6b6fc0a5a4154439e2b7f17eb3773849c28f891912a23d149aa24d3c8196573d1a7fe39a45cc59f76bd91
SSDEEP

24576:zjmOztIjpVbUJ44R/DDK2s5mNZRzOUCrA/N3r7:zqAtI704g/D3Tm03P

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe

description	pid	process	target process
PID 1068 set thread context of 2888	1068	5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe	5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe

pid	process
2888	5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe
2888	5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe
2888	5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe
2888	5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe
2888	5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe

description	pid	process	target process
PID 1068 wrote to memory of 2888	1068	5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe	5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe
PID 1068 wrote to memory of 2888	1068	5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe	5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe
PID 1068 wrote to memory of 2888	1068	5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe	5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe
PID 1068 wrote to memory of 2888	1068	5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe	5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe
PID 1068 wrote to memory of 2888	1068	5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe	5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe
PID 1068 wrote to memory of 2888	1068	5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe	5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe
PID 1068 wrote to memory of 2888	1068	5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe	5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe
PID 1068 wrote to memory of 2888	1068	5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe	5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe
PID 1068 wrote to memory of 2888	1068	5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe	5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe
PID 1068 wrote to memory of 2888	1068	5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe	5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe

C:\Users\Admin\AppData\Local\Temp\5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe
"C:\Users\Admin\AppData\Local\Temp\5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1068

C:\Users\Admin\AppData\Local\Temp\5c68cee69033809c6403d217bbe92de9add8c5276287e69224aa3450948034b0.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:2888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2888-132-0x0000000000000000-mapping.dmp

Download
memory/2888-133-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/2888-134-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/2888-135-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/2888-136-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/2888-137-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download