fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4

Analysis

max time kernel
91s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 08:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe
Size

1.3MB
MD5

31ed11c59d5f49e5169919f55f86c040
SHA1

e248e29f8a4ce653f607f76ac442f36e6c536beb
SHA256

fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4
SHA512

d3d4cd23f113949dcf827bb205c12f612d96543164e65ff4689a2d6fe8287710c9a8570a454227df2efa24a7cf3c1cb01fa1474f23868e6abf3bdd002d6d309c
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakb:zrKo4ZwCOnYjVmJPaM

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe

description	pid	process	target process
PID 4876 set thread context of 1016	4876	fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe	fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe

pid	process
1016	fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe
1016	fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe
1016	fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe
1016	fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe
1016	fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe

description	pid	process	target process
PID 4876 wrote to memory of 1016	4876	fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe	fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe
PID 4876 wrote to memory of 1016	4876	fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe	fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe
PID 4876 wrote to memory of 1016	4876	fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe	fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe
PID 4876 wrote to memory of 1016	4876	fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe	fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe
PID 4876 wrote to memory of 1016	4876	fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe	fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe
PID 4876 wrote to memory of 1016	4876	fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe	fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe
PID 4876 wrote to memory of 1016	4876	fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe	fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe
PID 4876 wrote to memory of 1016	4876	fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe	fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe
PID 4876 wrote to memory of 1016	4876	fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe	fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe
PID 4876 wrote to memory of 1016	4876	fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe	fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe

C:\Users\Admin\AppData\Local\Temp\fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe
"C:\Users\Admin\AppData\Local\Temp\fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4876

C:\Users\Admin\AppData\Local\Temp\fc47372b11bb83a03b3525c89ee1a602a5cbf46e6b2e37fd00ca296178f548b4.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:1016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1016-132-0x0000000000000000-mapping.dmp

Download
memory/1016-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1016-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1016-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1016-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1016-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1016-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download