Analysis
-
max time kernel
111s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 07:40
Static task
static1
Behavioral task
behavioral1
Sample
cd7c2985339b9336bb31a7df9133ebc3ec2b0fd96f342a977186b14c9c0c2e68.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
cd7c2985339b9336bb31a7df9133ebc3ec2b0fd96f342a977186b14c9c0c2e68.exe
Resource
win10v2004-20220901-en
General
-
Target
cd7c2985339b9336bb31a7df9133ebc3ec2b0fd96f342a977186b14c9c0c2e68.exe
-
Size
268KB
-
MD5
50e91db95700085e3fe74d1c3c6fe3b0
-
SHA1
738217560af5f90d87408b405c5c91454299c1ae
-
SHA256
cd7c2985339b9336bb31a7df9133ebc3ec2b0fd96f342a977186b14c9c0c2e68
-
SHA512
c9b6b1348e656ec9e2440a119c1dd697d710167323b520374fe3e36f0b1262745be6896b216f6303075f6e2d5703fdc4e7ff4892c2d8d0cc91604dafe9094f06
-
SSDEEP
6144:k4YvkVwj5q5hfaPA0XD6g2LFIzfpErWE6uDG2uusVMWLc2Ck2Rpz5Ab:k4rzfQ1WYuG72R
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
cd7c2985339b9336bb31a7df9133ebc3ec2b0fd96f342a977186b14c9c0c2e68.exedescription pid process target process PID 2340 set thread context of 4436 2340 cd7c2985339b9336bb31a7df9133ebc3ec2b0fd96f342a977186b14c9c0c2e68.exe cd7c2985339b9336bb31a7df9133ebc3ec2b0fd96f342a977186b14c9c0c2e68.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
cd7c2985339b9336bb31a7df9133ebc3ec2b0fd96f342a977186b14c9c0c2e68.exedescription pid process target process PID 2340 wrote to memory of 4436 2340 cd7c2985339b9336bb31a7df9133ebc3ec2b0fd96f342a977186b14c9c0c2e68.exe cd7c2985339b9336bb31a7df9133ebc3ec2b0fd96f342a977186b14c9c0c2e68.exe PID 2340 wrote to memory of 4436 2340 cd7c2985339b9336bb31a7df9133ebc3ec2b0fd96f342a977186b14c9c0c2e68.exe cd7c2985339b9336bb31a7df9133ebc3ec2b0fd96f342a977186b14c9c0c2e68.exe PID 2340 wrote to memory of 4436 2340 cd7c2985339b9336bb31a7df9133ebc3ec2b0fd96f342a977186b14c9c0c2e68.exe cd7c2985339b9336bb31a7df9133ebc3ec2b0fd96f342a977186b14c9c0c2e68.exe PID 2340 wrote to memory of 4436 2340 cd7c2985339b9336bb31a7df9133ebc3ec2b0fd96f342a977186b14c9c0c2e68.exe cd7c2985339b9336bb31a7df9133ebc3ec2b0fd96f342a977186b14c9c0c2e68.exe PID 2340 wrote to memory of 4436 2340 cd7c2985339b9336bb31a7df9133ebc3ec2b0fd96f342a977186b14c9c0c2e68.exe cd7c2985339b9336bb31a7df9133ebc3ec2b0fd96f342a977186b14c9c0c2e68.exe PID 2340 wrote to memory of 4436 2340 cd7c2985339b9336bb31a7df9133ebc3ec2b0fd96f342a977186b14c9c0c2e68.exe cd7c2985339b9336bb31a7df9133ebc3ec2b0fd96f342a977186b14c9c0c2e68.exe PID 2340 wrote to memory of 4436 2340 cd7c2985339b9336bb31a7df9133ebc3ec2b0fd96f342a977186b14c9c0c2e68.exe cd7c2985339b9336bb31a7df9133ebc3ec2b0fd96f342a977186b14c9c0c2e68.exe PID 2340 wrote to memory of 4436 2340 cd7c2985339b9336bb31a7df9133ebc3ec2b0fd96f342a977186b14c9c0c2e68.exe cd7c2985339b9336bb31a7df9133ebc3ec2b0fd96f342a977186b14c9c0c2e68.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd7c2985339b9336bb31a7df9133ebc3ec2b0fd96f342a977186b14c9c0c2e68.exe"C:\Users\Admin\AppData\Local\Temp\cd7c2985339b9336bb31a7df9133ebc3ec2b0fd96f342a977186b14c9c0c2e68.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cd7c2985339b9336bb31a7df9133ebc3ec2b0fd96f342a977186b14c9c0c2e68.exe"C:\Users\Admin\AppData\Local\Temp\cd7c2985339b9336bb31a7df9133ebc3ec2b0fd96f342a977186b14c9c0c2e68.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2340-132-0x0000000074F10000-0x00000000754C1000-memory.dmpFilesize
5.7MB
-
memory/2340-135-0x0000000074F10000-0x00000000754C1000-memory.dmpFilesize
5.7MB
-
memory/4436-133-0x0000000000000000-mapping.dmp
-
memory/4436-134-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/4436-136-0x0000000074F10000-0x00000000754C1000-memory.dmpFilesize
5.7MB
-
memory/4436-137-0x0000000074F10000-0x00000000754C1000-memory.dmpFilesize
5.7MB