fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697

Analysis

max time kernel
90s
max time network
101s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
24-04-2024 09:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe
Size

374KB
MD5

62d88827fb9ccfc3f5d7597e2b6883b1
SHA1

0f1389d5e715b82a992edc6512af12724f6450f9
SHA256

fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697
SHA512

f4f9b14eb6c60d50dc8de71fc0a3a3214df5c21d20a9a2f9e824878f22d7f36ca92f711c0267ee9d1c0afe91b420ec304f31fcab311c558a2234fb0ae927c9ca
SSDEEP

6144:tpIctLgefOPfgJlWm0w+1Jv0ao9b0L3ibpl/UPBxT:tpIctLgefO3ST0w+1Kzu3ibaD

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe

description	pid	process	target process
PID 5092 set thread context of 4868	5092	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe

description	pid	process	target process
PID 5092 wrote to memory of 4868	5092	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe
PID 5092 wrote to memory of 4868	5092	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe
PID 5092 wrote to memory of 4868	5092	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe
PID 5092 wrote to memory of 4868	5092	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe
PID 5092 wrote to memory of 4868	5092	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe
PID 5092 wrote to memory of 4868	5092	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe
PID 5092 wrote to memory of 4868	5092	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe
PID 5092 wrote to memory of 4868	5092	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe
PID 5092 wrote to memory of 4868	5092	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe

C:\Users\Admin\AppData\Local\Temp\fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe
"C:\Users\Admin\AppData\Local\Temp\fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Users\Admin\AppData\Local\Temp\fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe
  "C:\Users\Admin\AppData\Local\Temp\fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe"
  2⤵
  PID:4868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4868-3-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4868-5-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4868-6-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/5092-1-0x0000000004260000-0x0000000004360000-memory.dmp

Filesize
1024KB

Download
memory/5092-2-0x00000000045B0000-0x00000000045FC000-memory.dmp

Filesize
304KB

Download