1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598

Analysis

max time kernel
153s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe
Size

1.3MB
MD5

5d51986bace085d6493c9bb678d92b8d
SHA1

8e980c45e0df6d5b53d6b9a343f82419beff7705
SHA256

1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598
SHA512

e6d471ebcb958b1325196127102fa4e64a385550309f6661a0e56ca991c60077a24a7ef60ebd3f1fada1d193e1d81e501b26772fd70e59676992f10702ddbec1
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakf:TrKo4ZwCOnYjVmJPaM

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe

description	pid	process	target process
PID 1312 set thread context of 524	1312	1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe	1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe

pid	process
524	1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe
524	1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe
524	1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe
524	1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe
524	1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe

description	pid	process	target process
PID 1312 wrote to memory of 524	1312	1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe	1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe
PID 1312 wrote to memory of 524	1312	1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe	1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe
PID 1312 wrote to memory of 524	1312	1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe	1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe
PID 1312 wrote to memory of 524	1312	1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe	1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe
PID 1312 wrote to memory of 524	1312	1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe	1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe
PID 1312 wrote to memory of 524	1312	1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe	1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe
PID 1312 wrote to memory of 524	1312	1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe	1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe
PID 1312 wrote to memory of 524	1312	1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe	1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe
PID 1312 wrote to memory of 524	1312	1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe	1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe
PID 1312 wrote to memory of 524	1312	1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe	1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe

C:\Users\Admin\AppData\Local\Temp\1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe
"C:\Users\Admin\AppData\Local\Temp\1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1312

C:\Users\Admin\AppData\Local\Temp\1cdea2b6a34d353c6fd25ac46a3d0706f3feae7779642a97363bbcd0afcdd598.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/524-132-0x0000000000000000-mapping.dmp

Download
memory/524-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/524-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/524-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/524-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/524-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download