c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe
Size

1.1MB
MD5

4ebe1442508c7d97a3abed26499740b7
SHA1

c4edbe99e2ee4871bbe2571c374d27ed9e876d06
SHA256

c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b
SHA512

1249953a8ad6b62b2abb1014d87fb9e3b55b2119915ed0dd8d9b06e94cfc0e2bf5c3a16c44b208136070131f4496a372a1b1bef47049883da371a84788467979
SSDEEP

24576:jjmOztIjpVbUJ44R/DDK2s5mNZRzOUCrA/N3rk:jqAtI704g/D3Tm03g

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe

description	pid	process	target process
PID 1116 set thread context of 1260	1116	c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe	c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe

pid	process
1260	c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe
1260	c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe
1260	c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe
1260	c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe
1260	c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe

description	pid	process	target process
PID 1116 wrote to memory of 1260	1116	c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe	c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe
PID 1116 wrote to memory of 1260	1116	c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe	c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe
PID 1116 wrote to memory of 1260	1116	c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe	c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe
PID 1116 wrote to memory of 1260	1116	c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe	c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe
PID 1116 wrote to memory of 1260	1116	c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe	c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe
PID 1116 wrote to memory of 1260	1116	c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe	c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe
PID 1116 wrote to memory of 1260	1116	c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe	c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe
PID 1116 wrote to memory of 1260	1116	c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe	c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe
PID 1116 wrote to memory of 1260	1116	c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe	c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe
PID 1116 wrote to memory of 1260	1116	c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe	c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe

C:\Users\Admin\AppData\Local\Temp\c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe
"C:\Users\Admin\AppData\Local\Temp\c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Users\Admin\AppData\Local\Temp\c3f5b705b593bfef2d37199da1a4cce419378290457e548ddc44b0a2802e402b.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1260-132-0x0000000000000000-mapping.dmp

Download
memory/1260-133-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/1260-134-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/1260-135-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/1260-136-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/1260-137-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download