2c5b9875744f2f87bc76410024b5e76bbb75e8fc790b3435a792da16eb107f86

Analysis

Target

2d.exe
Size

148KB
MD5

38b50102f941b4f4cba161408cf20933
SHA1

a734a5bd0bf36f205baaa37a4ae84b21eca6b173
SHA256

8b1177549a1f4a0e47acd8ec77bf670ee18efb9f2c18747e460bd8924d5a2024
SHA512

25b513c41662ee4236baae15db95e25ea8defd4483c2d819047e0978253906b355f2f2425f7f4ea6e97994b0a83eb062c772578f24f94c32ad90578b6f2583cd

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

2d.exe

description pid process target process

PID 1364 set thread context of 912 1364 2d.exe 2d.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

2d.exe

pid process

912 2d.exe
912 2d.exe
912 2d.exe
912 2d.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

2d.exe

pid process

1364 2d.exe

description	pid	process	target process
PID 1364 set thread context of 912	1364	2d.exe	2d.exe

pid	process
1364	2d.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

2d.exe

description	pid	process	target process
PID 1364 wrote to memory of 912	1364	2d.exe	2d.exe
PID 1364 wrote to memory of 912	1364	2d.exe	2d.exe
PID 1364 wrote to memory of 912	1364	2d.exe	2d.exe
PID 1364 wrote to memory of 912	1364	2d.exe	2d.exe
PID 1364 wrote to memory of 912	1364	2d.exe	2d.exe
PID 1364 wrote to memory of 912	1364	2d.exe	2d.exe
PID 1364 wrote to memory of 912	1364	2d.exe	2d.exe
PID 1364 wrote to memory of 912	1364	2d.exe	2d.exe
PID 1364 wrote to memory of 912	1364	2d.exe	2d.exe
PID 1364 wrote to memory of 912	1364	2d.exe	2d.exe
PID 1364 wrote to memory of 912	1364	2d.exe	2d.exe

C:\Users\Admin\AppData\Local\Temp\2d.exe
"C:\Users\Admin\AppData\Local\Temp\2d.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:912

memory/912-57-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/912-58-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/912-59-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/912-60-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/912-61-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/912-62-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/912-63-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/912-64-0x000000000040522B-mapping.dmp

Download
memory/912-65-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download
memory/912-66-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1364-55-0x0000000000220000-0x0000000000226000-memory.dmp

Filesize
24KB

Download
memory/1364-56-0x0000000000220000-0x000000000022A000-memory.dmp

Filesize
40KB

Download