fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 08:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe
Size

1.3MB
MD5

35957168cc33a3b2a3d553689d255fd6
SHA1

3c73df4e65bab2a9942f9d7bbd04e92b923b4673
SHA256

fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f
SHA512

11a04d7e89b3937cbe449bc87b803ec2f21ebc980d8b66aa412d148b8e40ea5d1770fa8014617d17eee8a169bb88d7e58b7a07c4090d9b9b66ad8621263c34b9
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakf:zrKo4ZwCOnYjVmJPao

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe

description	pid	process	target process
PID 4780 set thread context of 2128	4780	fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe	fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe

pid	process
2128	fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe
2128	fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe
2128	fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe
2128	fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe
2128	fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe

description	pid	process	target process
PID 4780 wrote to memory of 2128	4780	fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe	fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe
PID 4780 wrote to memory of 2128	4780	fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe	fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe
PID 4780 wrote to memory of 2128	4780	fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe	fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe
PID 4780 wrote to memory of 2128	4780	fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe	fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe
PID 4780 wrote to memory of 2128	4780	fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe	fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe
PID 4780 wrote to memory of 2128	4780	fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe	fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe
PID 4780 wrote to memory of 2128	4780	fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe	fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe
PID 4780 wrote to memory of 2128	4780	fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe	fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe
PID 4780 wrote to memory of 2128	4780	fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe	fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe
PID 4780 wrote to memory of 2128	4780	fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe	fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe

C:\Users\Admin\AppData\Local\Temp\fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe
"C:\Users\Admin\AppData\Local\Temp\fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4780

C:\Users\Admin\AppData\Local\Temp\fc47d572c3e6b9c48fe6d34a5fd02ffb78abbc2ce6ee4643572a9e417b1ec29f.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:2128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2128-132-0x0000000000000000-mapping.dmp

Download
memory/2128-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2128-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2128-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2128-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2128-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2128-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download