c57d43fc6e69e16fb28ead676881a2eaccc7d64fd55f02fb7ba0146d9b94745a

Analysis

max time kernel
136s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 11:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cb4b632186957707135a40a2cc1fdaa7.exe
Size

250KB
MD5

cb4b632186957707135a40a2cc1fdaa7
SHA1

277341eeda6ea3148997d9bf1df91bf6f4046bb7
SHA256

c57d43fc6e69e16fb28ead676881a2eaccc7d64fd55f02fb7ba0146d9b94745a
SHA512

31937500b08d4c111942e92c0a79fa471fdb95dfbc941cdba58cd3bc644c52e66865d07bcf6ea77d5ad9c335df6c547676ee27a06f1dffe6c5a2d3889083e78a
SSDEEP

3072:mN6jJE4iM6wsdPLGBG2Ox+7umxab8SbNf1KeY90RnEzb9InSEHDu0i9SG9uuwhPO:Q6jJ3D3MGBG2F5AKeA0b2PArs9q5W

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4964 set thread context of 2360	4964	cb4b632186957707135a40a2cc1fdaa7.exe	88

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2360	cb4b632186957707135a40a2cc1fdaa7.exe
2360	cb4b632186957707135a40a2cc1fdaa7.exe
2360	cb4b632186957707135a40a2cc1fdaa7.exe
2360	cb4b632186957707135a40a2cc1fdaa7.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4964	cb4b632186957707135a40a2cc1fdaa7.exe
4964	cb4b632186957707135a40a2cc1fdaa7.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 2360	4964	cb4b632186957707135a40a2cc1fdaa7.exe	88
PID 4964 wrote to memory of 2360	4964	cb4b632186957707135a40a2cc1fdaa7.exe	88
PID 4964 wrote to memory of 2360	4964	cb4b632186957707135a40a2cc1fdaa7.exe	88
PID 4964 wrote to memory of 2360	4964	cb4b632186957707135a40a2cc1fdaa7.exe	88
PID 4964 wrote to memory of 2360	4964	cb4b632186957707135a40a2cc1fdaa7.exe	88
PID 4964 wrote to memory of 2360	4964	cb4b632186957707135a40a2cc1fdaa7.exe	88
PID 4964 wrote to memory of 2360	4964	cb4b632186957707135a40a2cc1fdaa7.exe	88
PID 2360 wrote to memory of 3384	2360	cb4b632186957707135a40a2cc1fdaa7.exe	56
PID 2360 wrote to memory of 3384	2360	cb4b632186957707135a40a2cc1fdaa7.exe	56
PID 2360 wrote to memory of 3384	2360	cb4b632186957707135a40a2cc1fdaa7.exe	56
PID 2360 wrote to memory of 3384	2360	cb4b632186957707135a40a2cc1fdaa7.exe	56
PID 2360 wrote to memory of 3384	2360	cb4b632186957707135a40a2cc1fdaa7.exe	56
PID 2360 wrote to memory of 3384	2360	cb4b632186957707135a40a2cc1fdaa7.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3384
- C:\Users\Admin\AppData\Local\Temp\cb4b632186957707135a40a2cc1fdaa7.exe
  "C:\Users\Admin\AppData\Local\Temp\cb4b632186957707135a40a2cc1fdaa7.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Users\Admin\AppData\Local\Temp\cb4b632186957707135a40a2cc1fdaa7.exe
    "C:\Users\Admin\AppData\Local\Temp\cb4b632186957707135a40a2cc1fdaa7.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2360-11-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2360-26-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/2360-24-0x0000000000410000-0x00000000004D9000-memory.dmp

Filesize
804KB

Download
memory/2360-16-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/2360-15-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2360-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3384-20-0x000000007FFC0000-0x000000007FFC6000-memory.dmp

Filesize
24KB

Download
memory/3384-18-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download
memory/4964-4-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4964-8-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4964-14-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4964-7-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4964-5-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4964-6-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4964-0-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4964-3-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4964-2-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4964-1-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download