cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729

Analysis

max time kernel
90s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 14:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe
Size

57KB
MD5

310da20a626d85819d981eddeb32ed27
SHA1

119be6fd440e39db4b6dd2459b9b9a2cde938ec5
SHA256

cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729
SHA512

9afca8f0bc415b678e717c766457b7adde1d28107fafdbc6f75457845232a34f2bc1b6f764d3abed3893b1290a717b64e9508c34b8472d10a4277a5b779d1ad8
SSDEEP

768:Jf5kuRDCss6nA+MiS1RlY8IAtf0ey3+NAKY7ohturWfADGjS5qQDJ7w6:3k2DW+MHQAd0F3+NXcK5+Ei

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe

description	pid	process	target process
PID 4568 set thread context of 4364	4568	cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe	cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe

description	pid	process	target process
PID 4568 wrote to memory of 3068	4568	cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe	cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe
PID 4568 wrote to memory of 3068	4568	cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe	cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe
PID 4568 wrote to memory of 3068	4568	cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe	cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe
PID 4568 wrote to memory of 4364	4568	cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe	cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe
PID 4568 wrote to memory of 4364	4568	cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe	cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe
PID 4568 wrote to memory of 4364	4568	cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe	cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe
PID 4568 wrote to memory of 4364	4568	cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe	cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe
PID 4568 wrote to memory of 4364	4568	cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe	cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe
PID 4568 wrote to memory of 4364	4568	cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe	cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe
PID 4568 wrote to memory of 4364	4568	cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe	cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe
PID 4568 wrote to memory of 4364	4568	cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe	cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe

C:\Users\Admin\AppData\Local\Temp\cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe
"C:\Users\Admin\AppData\Local\Temp\cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Users\Admin\AppData\Local\Temp\cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe
  "C:\Users\Admin\AppData\Local\Temp\cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe"
  2⤵
  PID:3068
- C:\Users\Admin\AppData\Local\Temp\cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe
  "C:\Users\Admin\AppData\Local\Temp\cc8a8c6398c102e8353036912efbf69cf039d709285448cd4443b5fe701e6729.exe"
  2⤵
  PID:4364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4364-133-0x0000000000000000-mapping.dmp

Download
memory/4364-135-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4568-132-0x0000000074F50000-0x0000000075501000-memory.dmp

Filesize
5.7MB

Download
memory/4568-134-0x0000000074F50000-0x0000000075501000-memory.dmp

Filesize
5.7MB

Download