33ea937a0a5f1c3cd1d4c475a5d8442374ab9cb825ea929d3335cdba8138198b

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28-12-2023 22:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcf556f0b11f47d9f215528fe6d98cf1.exe
Size

478KB
MD5

fcf556f0b11f47d9f215528fe6d98cf1
SHA1

ce334dcf2f5daf3de5da02188b58b222a130dbc4
SHA256

33ea937a0a5f1c3cd1d4c475a5d8442374ab9cb825ea929d3335cdba8138198b
SHA512

668dd9d5356208e2d511b30c24fcff85da8de41330ad1c3f2a0edc466c15e6a9508f56192d312e152ef57aede2388a82cf2c95e9e7a5c14f36af15f162cc6466
SSDEEP

12288:0euKz5I1qHhwlWoflw5DzbUv+a4oQR6M7:jnVI1qBwl9fIzbsQLIQ

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1984 set thread context of 1552	1984	fcf556f0b11f47d9f215528fe6d98cf1.exe	21

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1552	fcf556f0b11f47d9f215528fe6d98cf1.exe
1552	fcf556f0b11f47d9f215528fe6d98cf1.exe
1552	fcf556f0b11f47d9f215528fe6d98cf1.exe
1552	fcf556f0b11f47d9f215528fe6d98cf1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1984	fcf556f0b11f47d9f215528fe6d98cf1.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1552	1984	fcf556f0b11f47d9f215528fe6d98cf1.exe	21
PID 1984 wrote to memory of 1552	1984	fcf556f0b11f47d9f215528fe6d98cf1.exe	21
PID 1984 wrote to memory of 1552	1984	fcf556f0b11f47d9f215528fe6d98cf1.exe	21
PID 1984 wrote to memory of 1552	1984	fcf556f0b11f47d9f215528fe6d98cf1.exe	21
PID 1984 wrote to memory of 1552	1984	fcf556f0b11f47d9f215528fe6d98cf1.exe	21
PID 1984 wrote to memory of 1552	1984	fcf556f0b11f47d9f215528fe6d98cf1.exe	21
PID 1984 wrote to memory of 1552	1984	fcf556f0b11f47d9f215528fe6d98cf1.exe	21
PID 1552 wrote to memory of 3500	1552	fcf556f0b11f47d9f215528fe6d98cf1.exe	50
PID 1552 wrote to memory of 3500	1552	fcf556f0b11f47d9f215528fe6d98cf1.exe	50
PID 1552 wrote to memory of 3500	1552	fcf556f0b11f47d9f215528fe6d98cf1.exe	50
PID 1552 wrote to memory of 3500	1552	fcf556f0b11f47d9f215528fe6d98cf1.exe	50

C:\Users\Admin\AppData\Local\Temp\fcf556f0b11f47d9f215528fe6d98cf1.exe
"C:\Users\Admin\AppData\Local\Temp\fcf556f0b11f47d9f215528fe6d98cf1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Users\Admin\AppData\Local\Temp\fcf556f0b11f47d9f215528fe6d98cf1.exe
  C:\Users\Admin\AppData\Local\Temp\fcf556f0b11f47d9f215528fe6d98cf1.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1552

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1552-20-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1552-29-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1552-22-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1552-18-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1552-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1552-16-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1984-9-0x0000000002340000-0x0000000002350000-memory.dmp

Filesize
64KB

Download
memory/1984-3-0x00000000023A0000-0x00000000023B0000-memory.dmp

Filesize
64KB

Download
memory/1984-19-0x0000000000950000-0x000000000099E000-memory.dmp

Filesize
312KB

Download
memory/1984-11-0x00000000023A0000-0x00000000023B0000-memory.dmp

Filesize
64KB

Download
memory/1984-8-0x0000000000600000-0x0000000000610000-memory.dmp

Filesize
64KB

Download
memory/1984-7-0x0000000076050000-0x0000000076140000-memory.dmp

Filesize
960KB

Download
memory/1984-6-0x0000000000600000-0x0000000000610000-memory.dmp

Filesize
64KB

Download
memory/1984-4-0x0000000002340000-0x0000000002350000-memory.dmp

Filesize
64KB

Download
memory/1984-5-0x00000000770D2000-0x00000000770D3000-memory.dmp

Filesize
4KB

Download
memory/1984-21-0x0000000076050000-0x0000000076140000-memory.dmp

Filesize
960KB

Download
memory/1984-2-0x0000000000950000-0x000000000099E000-memory.dmp

Filesize
312KB

Download
memory/1984-1-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download
memory/1984-0-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1984-12-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1984-17-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3500-24-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/3500-23-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download