ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7

Analysis

max time kernel
185s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 00:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
Size

1.2MB
MD5

1edf1ec41b56c782ea1d4fd1148dc3b5
SHA1

85cd87cdf7c7a1d8c2074274c14d960e0b47751e
SHA256

ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7
SHA512

a0bc5c84b970a27784dab8e9ef6b388a28aa4b6e2bf4582d52356005b7f5b8c0bc3f1492264ef324807bdaba75d56bc7606946716d20e8bdbdfce168fc23f501
SSDEEP

24576:5bkiGUv38BEDWRR2cU1kPLtOF5Tr287ZTPcyAKYP+y42CA:uqvCEaRkca2Yb/3PmKxq9

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe

description	pid	process	target process
PID 1352 set thread context of 3992	1352	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe

pid	process
3992	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
3992	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
3992	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
3992	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
3992	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe

description	pid	process	target process
PID 1352 wrote to memory of 3992	1352	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
PID 1352 wrote to memory of 3992	1352	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
PID 1352 wrote to memory of 3992	1352	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
PID 1352 wrote to memory of 3992	1352	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
PID 1352 wrote to memory of 3992	1352	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
PID 1352 wrote to memory of 3992	1352	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
PID 1352 wrote to memory of 3992	1352	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
PID 1352 wrote to memory of 3992	1352	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
PID 1352 wrote to memory of 3992	1352	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
PID 1352 wrote to memory of 3992	1352	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe	ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe

C:\Users\Admin\AppData\Local\Temp\ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
"C:\Users\Admin\AppData\Local\Temp\ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1352

C:\Users\Admin\AppData\Local\Temp\ec2bc6e4663a6f4245b44a71c87b2c5a4044d546fd21cfc8842f04aedbfb1ff7.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:3992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3992-132-0x0000000000000000-mapping.dmp

Download
memory/3992-133-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/3992-134-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/3992-135-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/3992-136-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/3992-137-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/3992-138-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download