1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc

Analysis

max time kernel
305s
max time network
373s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe
Size

1.3MB
MD5

bc87dc7979d653d925a1faab8b153590
SHA1

8aef83e86c2415852000b7c2fe422dcfcb6fc8fd
SHA256

1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc
SHA512

77d3b2857bda2602deed7417bfc45a26adac9fc22f135921631a3a332b6cdbdf9f540cd76cd02b14d6dc85edc2382cb6156266f82740b8cb0f9eba9795c1f33e
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakq:zrKo4ZwCOnYjVmJPah

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe

description	pid	process	target process
PID 4356 set thread context of 4796	4356	1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe	1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe

pid	process
4796	1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe
4796	1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe
4796	1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe
4796	1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe
4796	1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe

description	pid	process	target process
PID 4356 wrote to memory of 4796	4356	1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe	1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe
PID 4356 wrote to memory of 4796	4356	1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe	1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe
PID 4356 wrote to memory of 4796	4356	1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe	1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe
PID 4356 wrote to memory of 4796	4356	1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe	1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe
PID 4356 wrote to memory of 4796	4356	1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe	1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe
PID 4356 wrote to memory of 4796	4356	1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe	1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe
PID 4356 wrote to memory of 4796	4356	1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe	1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe
PID 4356 wrote to memory of 4796	4356	1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe	1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe
PID 4356 wrote to memory of 4796	4356	1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe	1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe
PID 4356 wrote to memory of 4796	4356	1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe	1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe

C:\Users\Admin\AppData\Local\Temp\1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe
"C:\Users\Admin\AppData\Local\Temp\1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4356

C:\Users\Admin\AppData\Local\Temp\1c303cabd3a616cbe707b0887b51963e697e1d9d3d9ea5e6d9598fdc696c71bc.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4796-132-0x0000000000000000-mapping.dmp

Download
memory/4796-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4796-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4796-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4796-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download